Skip to content

v2.100+ breaks auth flow (conf with pw -> conf with access token) when logging in with password #3445

New issue
New issue
Open
Open
v2.100+ breaks auth flow (conf with pw -> conf with access token) when logging in with password#3445
Labels
bugSomething isn't working

Description

@nneul
nneul
opened on Apr 19, 2026

Describe the bug

Have filed this with support as 410604 fyi.

After 2.99 - the client is not successfully replacing login PW with a refreshable access token. Note that it does still work ok if you are logging in with a refToken, but not if the login is being set up with a password. This broke various workflows in weird/inconsistent ways - cause it "mostly works" - but the failures are triggering enough 401's that certain build patterns are getting into modes where it's not able to get past the error/retry behaviors/etc.

Current behavior

Test example:

export CI=TRUE
export JFROG_CLI_LOG_LEVEL=DEBUG
export JFROG_CLI_HOME_DIR=/tmp/jftest
rm -rf /tmp/jftest
jf c add artifactory --url https://artifactory.domain.com --user internal_build_velocity --password $PASSWORD
cat /tmp/jftest/jfrog-cli.conf.v6
jf rt s --count misc-binaries
cat /tmp/jftest/jfrog-cli.conf.v6

When I do that with a password, this is what I get:

11:33:53 [Debug] JFrog CLI version: 2.101.0
11:33:53 [Debug] OS/Arch: linux/amd64
11:33:53 [Debug] Trace ID for JFrog Platform logs: 4bf9021cc116b0a4
11:33:53 [Debug] Locking config file to run config AddOrEdit command.
11:33:53 [Debug] Creating lock in: /tmp/jftest/locks/config
11:33:53 [Debug] config file is released.
11:33:53 [Debug] Sending HTTP GET request to: https://artifactory.domain.com/artifactory/api/security/encryptedPassword
11:33:53 [Debug] Releasing lock: /tmp/jftest/locks/config/jfrog-cli.conf.lck.1907218.1776616433355778643
{
 "servers": [
  {
   "url": "https://artifactory.domain.com/",
   "artifactoryUrl": "https://artifactory.domain.com/artifactory/",
   "distributionUrl": "https://artifactory.domain.com/distribution/",
   "xrayUrl": "https://artifactory.domain.com/xray/",
   "missionControlUrl": "https://artifactory.domain.com/mc/",
   "pipelinesUrl": "https://artifactory.domain.com/pipelines/",
   "user": "internal_build_velocity",
   "password": "APxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxX",
   "tokenRefreshInterval": 60,
   "serverId": "artifactory",
   "isDefault": true
  }
 ],
 "version": "6"
}11:33:53 [Debug] JFrog CLI version: 2.101.0
11:33:53 [Debug] OS/Arch: linux/amd64
11:33:53 [Debug] Trace ID for JFrog Platform logs: 9bba5d1508ce98a0
11:33:53 [Debug] Using <artifactory> server-id configuration
11:33:53 [Debug] Creating lock in: /tmp/jftest/locks/config
11:33:53 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/access/api/v1/tokens
11:33:54 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/access/api/v1/tokens
11:33:54 [Debug] Access token creation with Bearer auth failed: server response: 401 Unauthorized
{
 "errors": [
  {
   "code": "UNAUTHORIZED",
   "message": "Invalid token, parse"
  }
 ]
}
11:33:54 [Debug] Releasing lock: /tmp/jftest/locks/config/jfrog-cli.conf.lck.1907238.1776616433663359796
11:33:54 [🔵Info] Searching artifacts...
11:33:54 [Debug] Sending HTTP GET request to: https://artifactory.domain.com/artifactory/api/system/version
11:33:54 [Debug] Sending HTTP GET request to: https://artifactory.domain.com/artifactory/api/system/version
11:33:54 [Debug] Artifactory response: 200 
11:33:54 [Debug] JFrog Artifactory version is: 7.146.7
11:33:54 [Debug] Searching Artifactory using AQL query:
 items.find({"$or":[{"$and":[{"repo":"misc-binaries","path":{"$match":"*"},"name":{"$match":"*"}}]}]}).include("name","repo","path","actual_md5","actual_sha1","sha256","size","type","modified","created","property")
11:33:54 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/artifactory/api/search/aql
11:33:54 [Debug] Artifactory response: 200 
11:33:54 [Debug] Artifactory Call Home: Sending info...
11:33:54 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/artifactory/api/system/usage
11:33:54 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/jfconnect/api/v1/backoffice/metrics/log
11:33:55 [Debug] Artifactory response: 200 
11:33:55 [Debug] Streaming data to file...
11:33:55 [Debug] Finished streaming data successfully.
11:33:55 [🔵Info] Found 211 artifacts.
11:33:55 [Debug] Attempting to remove file: /tmp/jfrog.cli.temp.-1776616435-884548194
211
11:33:55 [Debug] Attempting to remove file: /tmp/jfrog.cli.temp.-1776616435-833335798
{
 "servers": [
  {
   "url": "https://artifactory.domain.com/",
   "artifactoryUrl": "https://artifactory.domain.com/artifactory/",
   "distributionUrl": "https://artifactory.domain.com/distribution/",
   "xrayUrl": "https://artifactory.domain.com/xray/",
   "missionControlUrl": "https://artifactory.domain.com/mc/",
   "pipelinesUrl": "https://artifactory.domain.com/pipelines/",
   "user": "internal_build_velocity",
   "password": "AxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxX",
   "tokenRefreshInterval": 60,
   "serverId": "artifactory",
   "isDefault": true
  }
 ],
 "version": "6"
}

Reproduction steps

Basic test:
Set up temp jf home env vars and debug
jf c add with url, username, pw
look at content of config - will have username and encrypted pw
jf s
look at content of config - willl still have username and encrypted pw
You'll see a 401 token error in the jf search.

Expected behavior

For it to work as it did before:

jf c add -> file with enc pw -> jf s -> config content replaced with refreshable access token

Here's what it does when it works:

nneul@optic:/local/spirent/jenkins-credential-tests/jenkins-ito$ rm -rf /tmp/jftest; jf c add artifactory --url https://artifactory.domain.com --user internal_build_velocity --password 0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxd03; cat /tmp/jftest/jfrog-cli.conf.v6; jf rt s --count misc-binaries; cat /tmp/jftest/jfrog-cli.conf.v6
12:04:59 [Debug] JFrog CLI version: 2.99.0
12:04:59 [Debug] OS/Arch: linux/amd64
12:04:59 [Debug] Trace ID for JFrog Platform logs: 620f08efb61394cd
12:04:59 [Debug] Locking config file to run config AddOrEdit command.
12:04:59 [Debug] Creating lock in: /tmp/jftest/locks/config
12:04:59 [Debug] config file is released.
12:04:59 [Debug] Sending HTTP GET request to: https://artifactory.domain.com/artifactory/api/security/encryptedPassword
12:05:00 [Debug] Releasing lock: /tmp/jftest/locks/config/jfrog-cli.conf.lck.1912576.1776618299892418600
{
 "servers": [
  {
   "url": "https://artifactory.domain.com/",
   "artifactoryUrl": "https://artifactory.domain.com/artifactory/",
   "distributionUrl": "https://artifactory.domain.com/distribution/",
   "xrayUrl": "https://artifactory.domain.com/xray/",
   "missionControlUrl": "https://artifactory.domain.com/mc/",
   "pipelinesUrl": "https://artifactory.domain.com/pipelines/",
   "user": "internal_build_velocity",
   "password": "AxxxxxxxxxxxxwX",
   "tokenRefreshInterval": 60,
   "serverId": "artifactory",
   "isDefault": true
  }
 ],
 "version": "6"
}12:05:00 [Debug] JFrog CLI version: 2.99.0
12:05:00 [Debug] OS/Arch: linux/amd64
12:05:00 [Debug] Trace ID for JFrog Platform logs: b6f797ea1ccc3dc3
12:05:00 [Debug] Using <artifactory> server-id configuration
12:05:00 [Debug] Creating lock in: /tmp/jftest/locks/config
12:05:00 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/artifactory/api/security/token
12:05:00 [Debug] Releasing lock: /tmp/jftest/locks/config/jfrog-cli.conf.lck.1912597.1776618300225727521
12:05:00 [🔵Info] Searching artifacts...
12:05:00 [Debug] Sending HTTP GET request to: https://artifactory.domain.com/artifactory/api/system/version
12:05:00 [Debug] Sending HTTP GET request to: https://artifactory.domain.com/artifactory/api/system/version
12:05:00 [Debug] Artifactory response: 200 
12:05:00 [Debug] Artifactory response: 200 
12:05:00 [Debug] JFrog Artifactory version is: 7.146.7
12:05:00 [Debug] Artifactory Call Home: Sending info...
12:05:00 [Debug] Searching Artifactory using AQL query:
 items.find({"$or":[{"$and":[{"repo":"misc-binaries","path":{"$match":"*"},"name":{"$match":"*"}}]}]}).include("name","repo","path","actual_md5","actual_sha1","sha256","size","type","modified","created","property")
12:05:00 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/artifactory/api/search/aql
12:05:00 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/artifactory/api/system/usage
12:05:00 [Debug] Sending HTTP POST request to: https://artifactory.domain.com/jfconnect/api/v1/backoffice/metrics/log
12:05:00 [Debug] Artifactory response: 200 
12:05:00 [Debug] Streaming data to file...
12:05:00 [Debug] Finished streaming data successfully.
12:05:01 [🔵Info] Found 211 artifacts.
12:05:01 [Debug] Attempting to remove file: /tmp/jfrog.cli.temp.-1776618300-1085820854
211
12:05:01 [Debug] Attempting to remove file: /tmp/jfrog.cli.temp.-1776618301-4195906315
{
 "servers": [
  {
   "url": "https://artifactory.domain.com/",
   "artifactoryUrl": "https://artifactory.domain.com/artifactory/",
   "distributionUrl": "https://artifactory.domain.com/distribution/",
   "xrayUrl": "https://artifactory.domain.com/xray/",
   "missionControlUrl": "https://artifactory.domain.com/mc/",
   "pipelinesUrl": "https://artifactory.domain.com/pipelines/",
   "user": "internal_build_velocity",
   "password": "APxxxxxxxxxxxxxxxxxwX",
   "accessToken": "xxxxx-xxxxxxxx",
   "artifactoryRefreshToken": "f643xxxxxxxxxxxxxxxxxxxxx1",
   "serverId": "artifactory",
   "isDefault": true
  }
 ],
 "version": "6"
}

You can see the correct flow, with no 401 failure on the initial token refresh.

JFrog CLI version

2.100

Operating system type and version

Debian 13

JFrog Artifactory version

7.146.7

JFrog Xray version

na

Activity

  1. nneul
    added
    bugSomething isn't working
    on Apr 19, 2026

  2. nneul commented on Apr 19, 2026

    @nneul
    nneul
    on Apr 19, 2026
    Author

    I'm not seeing anything jumping out at me in the jfrog-cli code itself from v2.99.0..v2.100.0 - so suspect it was something in the included/dependent libraries modules jfrog-cli-artifactory, jfrog-cli-core

  3. nneul commented on Apr 19, 2026

    @nneul
    nneul
    on Apr 19, 2026
    Author
    -github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260406055206-755b2b3eb84d h1:yIVNT/vDk4WZVaBOdpOZ8ex8YhywDuH6253edchKHzM=
-github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260406055206-755b2b3eb84d/go.mod h1:KSJZO+tguFpGG4TE2Ut2rmOk1j03RrqHQ7E33FrsEt4=
-github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260402104745-7a0bc2c11d63 h1:rvEiuETYgy7VbQFmf1QeYTcG0Sp4Lr+1QgrVQzLV58Q=
-github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260402104745-7a0bc2c11d63/go.mod h1:RLLUO+oGDq88e5DPtP/KK2sVgMF32OuoRdVMxSFfb30=
-github.com/jfrog/jfrog-cli-evidence v0.9.1 h1:Epj2gwPv39qZrYfS2/N3AhCQ0ZG4t5C5ExHNgYlM4e4=
-github.com/jfrog/jfrog-cli-evidence v0.9.1/go.mod h1:R9faPfyQESBmKrdZCmHvlpmYSHmffswjNnFeT3RMq8I=
+github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260414085427-0d891fde6d05 h1:BNLs4VBRU3UrQTwEQSJw/5CaCgGMc1YDftpUgtb1GUI=
+github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260414085427-0d891fde6d05/go.mod h1:u2yb7nO6VLxXwHKoICnxd8NEY4OclCk9YAi2n/Sbpn8=
+github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260414083544-243b4d55328b h1:PCvNCdTYojr9u5X5TVTj/3oSnHEe8kJ9I50X0Wb5iJg=
+github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260414083544-243b4d55328b/go.mod h1:RLLUO+oGDq88e5DPtP/KK2sVgMF32OuoRdVMxSFfb30=
+github.com/jfrog/jfrog-cli-evidence v0.9.2 h1:huiBzQSI9z3OF3l2RphthdXl1aH9zBsvAt+zLsApORI=
+github.com/jfrog/jfrog-cli-evidence v0.9.2/go.mod h1:R9faPfyQESBmKrdZCmHvlpmYSHmffswjNnFeT3RMq8I=

    This jumps out in jfrog-cli-artifactory:

    Author: reshmifrog <reshmig@jfrog.com>
Date:   Tue Apr 14 14:05:44 2026 +0530

    Fix reference token privilege escalation (#1540)

    Yup - in that change:

    +       // If basic auth failed and a password is available, retry using it as a Bearer token.
+       // This handles reference tokens, which the Access service can resolve server-side.
+       if serverDetails.Password != "" {
+               bearerDetails := serverDetailsForBearerAuth(serverDetails, serverDetails.Password)
+               servicesManager, err = createAccessTokensServiceManager(bearerDetails)
+               if err != nil {
+                       return auth.CreateTokenResponseData{}, err
+               }
+               newToken, err = servicesManager.CreateAccessToken(createTokenParams)
+               if err == nil {
+                       return newToken, nil
+               }
+               log.Debug("Access token creation with Bearer auth failed: " + err.Error())
+       }

  4. jdknight commented on May 1, 2026

    @jdknight
    jdknight
    on May 1, 2026

    I observe this issue as well. Uploads appear to fail 40% of the time. Working around it by using v2.99 for now (as noted above):

    curl -fL https://install-cli.jfrog.io | sh -s -- 2.99.0

  5. pinguincoding commented on Oct 1, 2026

    @pinguincoding
    pinguincoding
    on Oct 1, 2026

    Any updates on this yet? We’re currently sticking with version 2.96.0 due to the issue described above. However, as of today, the latest version of JFrog CLI is 2.124.0. Thanks!

  6. isa-tairi commented on Oct 2, 2026

    @isa-tairi
    isa-tairi
    on Oct 2, 2026

    Any updates on this yet? We’re currently sticking with version 2.96.0 due to the issue described above. However, as of today, the latest version of JFrog CLI is 2.124.0. Thanks!

    We created a ticket with the support some time ago and never got an update regarding the issue.
    Today (after asking what the status was) we were informed that the issue was fixed with 2.108.0 (our ticket was created after the release of the version).
    #3537

    Didn't test it yet, but the information might help others.

  7. pinguincoding commented on Oct 6, 2026

    @pinguincoding
    pinguincoding
    on Oct 6, 2026

    Any updates on this yet? We’re currently sticking with version 2.96.0 due to the issue described above. However, as of today, the latest version of JFrog CLI is 2.124.0. Thanks!

    We created a ticket with the support some time ago and never got an update regarding the issue. Today (after asking what the status was) we were informed that the issue was fixed with 2.108.0 (our ticket was created after the release of the version). #3537

    Didn't test it yet, but the information might help others.

    Oh, wow! Thank you.

    We're now using the latest version in our build environment and everything looks fine. I think this issue can be closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions