RTECO-524 - Add proxy support for OIDC authentication by agrasth · Pull Request #593 · jfrog/jfrog-azure-devops-extension

agrasth · 2026-03-26T11:52:02Z

All tests passed. If this feature is not already covered by the tests, I added new tests.
This pull request is on the dev branch.
I used npm run format for formatting the code before submitting the pull request.

Add proxy support for OIDC authentication

Summary

The JFrog Azure DevOps extension now supports proxy configurations when retrieving OIDC tokens from Azure DevOps. Previously, the OIDC token request (POST https://dev.azure.com/.../_apis/distributedtask/hubs/.../oidctoken) used the synchronous sync-request library, which does not honor proxy settings. This caused OIDC authentication to fail when the Azure DevOps Agent runs behind a proxy.

Problem

When an Azure DevOps Agent is deployed within an intranet behind a proxy, the extension's OIDC flow fails silently because:

sync-request does not support proxy configuration.
The extension did not read Azure DevOps Agent proxy variables (Agent.ProxyUrl, Agent.ProxyUsername, Agent.ProxyPassword, Agent.ProxyBypassList).

Solution

Replaced sync-request with the async typed-rest-client/HttpClient (already a project dependency) for the OIDC token fetch. This client natively supports proxy configuration and automatically respects HTTP_PROXY/HTTPS_PROXY environment variables.
Added getProxyConfiguration() to explicitly read Azure DevOps Agent proxy variables and pass them to the HTTP client.
Moved the OIDC resolution logic from configureSpecificCliServer (shared by all connection types) into configureJfrogCliServer (JFrog platform connections only), keeping the async footprint minimal.

Async impact

Only the OIDC code path is async. All other connection types (Artifactory, Distribution, Xray) and all other task files remain fully synchronous and unchanged.

Proxy support matrix

Proxy source	Supported
`HTTP_PROXY` / `HTTPS_PROXY` env vars	Yes (handled automatically by `typed-rest-client`)
`Agent.ProxyUrl` / `Agent.ProxyUsername` / `Agent.ProxyPassword` / `Agent.ProxyBypassList`	Yes (handled explicitly by `getProxyConfiguration()`)

itsmeleela · 2026-04-10T04:30:07Z

+            proxyUrl = parsed.toString();
+        } catch (e) {
+            tl.warning('Failed to parse proxy URL: ' + e.message);
+            return;


If the URL parse fails (malformed proxy URL), the function returns without setting any proxy env vars. That means the user's proxy is silently dropped. Is that correct?

I think better approach: warn and fall through with the original proxyUrl (without credentials), rather than abandoning proxy support entirely. The user gets a degraded experience (unauthenticated proxy) rather than no proxy at all.

@bhanurp any thoughts?

Fixed. Removed the return on parse failure — the function now warns and falls through with the original proxyUrl (without credentials), so proxy support isn't lost when the URL can't be parsed.

itsmeleela · 2026-04-10T04:31:58Z

+    assert.strictEqual(config.proxy.proxyPassword, 'pass');
+    clearProxyVars();
+});
+


I don't see a test for forwardProxyToEnv() when URL parse throws (the return on parse failure path) should be covered.

Updated the existing forwardProxyToEnv handles invalid proxy URL gracefully test to match the new behavior. It now asserts that HTTP_PROXY and HTTPS_PROXY are set to the original URL when parsing fails (credentials not included).

itsmeleela · 2026-04-10T04:32:58Z

+    assert.strictEqual(config.proxy.proxyUsername, undefined);
+    clearProxyVars();
+});
+


I don't see any tests for Agent.ProxyUrl set + HTTP_PROXY already in env- we need to check taht don't override kind of guard you wrote right?

Already covered — check forwardProxyToEnv does not override existing HTTP_PROXY (line 172 in proxyConfigTest.js).
It sets both process.env.HTTP_PROXY = 'http://existing:9090' and Agent.ProxyUrl = 'http://myproxy:8080' and asserts HTTP_PROXY stays unchanged.

itsmeleela · 2026-04-10T04:36:50Z

+        proxyUrl = process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY || process.env.http_proxy;
+        if (proxyUrl) {
+            tl.debug('Using proxy from environment variable: ' + proxyUrl);
+        }


The fallback here is inside the else branch meaning it only applies when Agent.ProxyUrl is absent. But forwardProxyToEnv() already set HTTP_PROXY/HTTPS_PROXY from Agent.ProxyUrl earlier in executeCliTask.

So if Agent.ProxyUrl is set:
forwardProxyToEnv() sets HTTP_PROXY/HTTPS_PROXY in the environment
getProxyConfiguration() reads Agent.ProxyUrl directly (not the env vars)

But if a user sets HTTP_PROXY manually and Agent.ProxyUrl is also set, getProxyConfiguration() will use Agent.ProxyUrl for the typed-rest-client while HTTP_PROXY might point somewhere different.

This dual-source behavior should be documented right? WTDY?

Added a JSDoc block on getProxyConfiguration explaining the behavior: when Agent.ProxyUrl is set, typed-rest-client uses it directly via this function, while forwardProxyToEnv separately forwards it into HTTP_PROXY/HTTPS_PROXY for JFrog CLI.
If a user also has a different HTTP_PROXY set manually, the two sources diverge intentionally — forwardProxyToEnv never overrides a pre-existing env var.

itsmeleela · 2026-04-10T04:40:00Z

+    const requestOptions = getProxyConfiguration();
+    const httpClient = new httpm.HttpClient(buildAgent, [new credentialsHandler.BearerCredentialHandler(token, false)], requestOptions);
+    tl.debug('Requesting OIDC token from: ' + url);
+    const response = await httpClient.post(url, JSON.stringify({}), {


If the OIDC endpoint hangs or is unreachable, await httpClient.post(...) will never resolve, leaving the pipeline task stuck indefinitely with no way to recover short of the agent's own job timeout (which is typically 60 minutes based on documentation I read)

So I think requestOptions should have timeout also I feel.

const requestOptions = { ...getProxyConfiguration(), socketTimeout: 30000 };

Fixed. Added socketTimeout: 30000 to the request options on the fetchAzureOidcToken call so a hung endpoint won't block the pipeline indefinitely.

RTECO-524 - Add proxy support for OIDC authentication

6d26549

agrasth had a problem deploying to frogbot March 26, 2026 11:52 — with GitHub Actions Failure

Added tests and a fix

d64c2a8

agrasth had a problem deploying to frogbot March 27, 2026 08:33 — with GitHub Actions Failure

agrasth marked this pull request as ready for review March 30, 2026 06:49

Fixed Lint issues

a69edef

agrasth had a problem deploying to frogbot March 30, 2026 06:58 — with GitHub Actions Failure

agrasth had a problem deploying to frogbot March 30, 2026 09:36 — with GitHub Actions Failure

Add HTTPS_PROXY/HTTP_PROXY env var fallback to getProxyConfiguration

c68c882

agrasth force-pushed the bugfix/RTECO-524 branch from f2298dc to c68c882 Compare March 30, 2026 09:43

agrasth had a problem deploying to frogbot March 30, 2026 09:44 — with GitHub Actions Failure

bhanurp added the safe to test Approve running integration tests on a pull request label Apr 6, 2026

github-actions Bot removed the safe to test Approve running integration tests on a pull request label Apr 6, 2026

bhanurp reviewed Apr 9, 2026

View reviewed changes

Comment thread tests/proxyConfigTest.js Outdated

Comment thread jfrog-tasks-utils/utils.js Outdated

Comment thread jfrog-tasks-utils/utils.js Outdated

Comment thread jfrog-tasks-utils/utils.js

Comment thread jfrog-tasks-utils/utils.js

Resolved comments.

fb2da7d

agrasth requested a deployment to frogbot April 9, 2026 06:03 — with GitHub Actions Waiting

agrasth requested a review from bhanurp April 9, 2026 06:03

bhanurp approved these changes Apr 9, 2026

View reviewed changes

itsmeleela reviewed Apr 10, 2026

View reviewed changes

bugfix/RTECO-524 - Fixed reviewed comments.

2b185b4

agrasth requested a deployment to frogbot April 13, 2026 09:53 — with GitHub Actions Waiting

agrasth merged commit 72e5a1b into jfrog:v2 Apr 13, 2026
3 of 4 checks passed

agrasth added a commit that referenced this pull request Apr 13, 2026

RTECO-524 - Add proxy support for OIDC authentication (#593)

b6500ec

chaitanyagovande mentioned this pull request Apr 21, 2026

OIDC Authentication failing silently and reverting to basic auth #608

Closed

agrasth mentioned this pull request Apr 21, 2026

Fix OIDC token exchange was not being performed for JFrog Artifactory V2, Distribution, and Xray service connections #609

Merged

3 tasks

Conversation

agrasth commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Add proxy support for OIDC authentication

Summary

Problem

Solution

Async impact

Proxy support matrix

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

agrasth commented Mar 26, 2026 •

edited

Loading