ARTIFACTORY: How to Identify Basic Authentication Whitelisted Users via Database and UI

1. Overview / Introduction

When global Basic Authentication is disabled across JFrog Artifactory, administrators often whitelist specific break-glass accounts to retain username/password login capabilities during external Identity Provider (IdP) outages. This article provides step-by-step instructions to audit and identify which users maintain Basic Authentication privileges, either through the Artifactory Web UI or via direct database queries.

2. The Reason For this

• Security compliance audits require verification of all break-glass accounts that bypass global Single Sign-On (SSO) or SAML settings.

• Need to verify which accounts retain username/password login capabilities when Web UI access is degraded or unavailable.

3. Root Cause

When global Basic Authentication is turned off in Artifactory, the platform manages user-level exemptions within the Access service data model. Accounts permitted to use username and password authentication are flagged in the access_users_custom_data table under the property key basicAuthWhiteListed.

If Web UI access is lost during an IdP emergency, administrators must query this table directly in the database to locate whitelisted break-glass account IDs and map them back to active usernames.

4. Step-by-Step Solution

Option 1: View Whitelisted Users via the Web UI

1. Log into your Artifactory Web UI as an Administrator.

2. Navigate to Administration > User Management > Users.

3. Inspect user profile settings to review accounts configured with Allow Basic Authentication permissions.

Option 2: Query Whitelisted Users via the PostgreSQL Database

If the UI is unreachable, query the Artifactory database directly using SQL:

1. Connect to the PostgreSQL database instance:

Bash

psql -U artifactory -d artifactory

2. Query the access_users_custom_data table for all records marked with the basicAuthWhiteListed property:

SQL

SELECT * FROM access_users_custom_data WHERE prop_key='basicAuthWhiteListed';

Sample Database Output:

Plaintext

-[ RECORD 1 ]------+---------------------
user_id            | 2
prop_key           | basicAuthWhiteListed
prop_value         | true
prop_sensitive     | 0
prop_cluster_local | 0

3. Retrieve the corresponding username from the access_users table using the user_id obtained in the previous step:

SQL

SELECT user_id, username, created FROM access_users WHERE user_id = 2;

4. (Optional) Run a single consolidated query to list all whitelisted usernames at once:

SQL

SELECT u.user_id, u.username, c.prop_value AS basic_auth_whitelisted
FROM access_users u
JOIN access_users_custom_data c ON u.user_id = c.user_id
WHERE c.prop_key = 'basicAuthWhiteListed' AND c.prop_value = 'true';

5. Verification

1. Run the consolidated SQL query above to confirm that only authorized break-glass administrative accounts appear in the result set.

2. Verify basic authentication functionality for a whitelisted user via curl:

Bash

curl -u <WHITELISTED_USERNAME>:<PASSWORD> "https://<ARTIFACTORY_URL>/artifactory/api/system/ping"

4. A successful request will return an HTTP 200 OK response with OK.

6. Related Resources

• JFrog Documentation: User Management

• JFrog Documentation: General Security Settings