Jenkins proxy 407 error

Question

I'm running Jenkins CI inside a corporate network which uses a proxy for internet access.

I tried to configure proxy details in Plugins->Advanced, but even though the credentials are correct (yeah, I checked it a bunch of times), it cannot validate "Test URL" even on http://google.com and returns

Failed to connect to http://google.com (code 407).

Strangely, Jenkins is still able to download plugins itself (whoa!), but totally unable to connect to any HTTP resource. The message that outputs from the console is:

←[0mApr 16, 2015 1:58:56 PM org.apache.commons.httpclient.HttpMethodDirector pro cessProxyAuthChallenge INFO: Failure authenticating with NTLM @proxyrye.asg.com:80 Apr 16, 2015 2:09:09 PM org.apache.commons.httpclient.HttpMethodDirector execute WithRetry INFO: I/O exception (java.net.ConnectException) caught when processing request: Connection timed out: connect Apr 16, 2015 2:09:09 PM org.apache.commons.httpclient.HttpMethodDirector execute WithRetry INFO: Retrying request Apr 16, 2015 2:09:10 PM org.apache.commons.httpclient.auth.AuthChallengeProcesso r selectAuthScheme INFO: ntlm authentication scheme selected ←[31mApr 16, 2015 2:09:10 PM org.apache.commons.httpclient.HttpMethodDirector au thenticate SEVERE: Credentials cannot be used for NTLM authentication: org.apache.commons.h ttpclient.UsernamePasswordCredentials org.apache.commons.httpclient.auth.InvalidCredentialsException: Credentials cann ot be used for NTLM authentication: org.apache.commons.httpclient.UsernamePasswo rdCredentials at org.apache.commons.httpclient.auth.NTLMScheme.authenticate(NTLMScheme .java:332)

Answer 1

We had this issue a rather long time with our Jenkins behind our company's proxy. The other day they changed the order of authentication schemes our proxy desires. This was the day our Jenkins stopped connecting to the internet.

Obviously Jenkins is not able to connect via a proxy that requires NTML authentication. This was what lead me to issue an improvement for Jenkins to extend the proxy configuration screen. During the work on the extension I discovered that Jenkins does not make use of all proxy related system properties, therefore it cannot work with NTLM.

As such the answer for a proxy that allows only NTLM authentication is: it will not work via the Jenkins UI.

But if your proxy allows other authentication schemes, you can follow our workaround, it is rather simple: add the java system property -Dhttp.auth.preference="basic" to your Jenkins startup script or to that one of your container.

This will force the underlying libraries and Java mechanisms Jenkins makes use of to connect to your proxy using basic authentication, not NTLM.