Galleon authentication uses a password and a user token; the access model is described in Access control.
Password
The password is used to sign in to the web interface. It can be changed in the profile: the avatar menu → “Profile” → “Change password” (the current password is required). If the administrator has required a password change, all other actions in the web interface are blocked until it is completed.
User token
In command-line clients and CI, use the token instead of the password: it is supplied as a regular username/password pair, and if compromised, it can be revoked without changing the account password.
To generate a token, follow these steps:
- Open “Profile”, the “User token” section.
- Click “Generate”.
- Save the displayed values: use “Name code” as the username and “Pass code” as the password.
The pass code is shown only once — right after generation. If the value is lost, generate the token anew.
Each user can have one active token:
- “Regenerate” issues a new token in place of the old one — the old credentials stop working immediately;
- “Delete” revokes the token without issuing a new one.
Using the credentials in clients
The token (or the password) is supplied wherever a format client expects a username and password:
in docker login, Maven settings.xml, .npmrc, ~/.pypirc, ~/.netrc, and others.
Ready-made examples for every client are collected in the Formats section.
RubyGems (the ~/.gem/credentials file) and Cargo (the cargo login command)
take the credentials as a ready authorization header string Basic <BASE64>,
where <BASE64> is <USERNAME>:<PASSWORD> encoded in base64.
See the RubyGems and Cargo pages for details.
If the client gets an error
A 401 answer means the credentials were not accepted: most often the token was
regenerated with “Regenerate” or removed with “Delete”, and the old values stopped working.
A 403 answer means a privilege for the operation is missing — ask your administrator for the rights.
A 404 answer comes both for a missing artifact and for missing access rights
(Access control),
and for proxy repositories — from the negative cache as well
(Proxying and caching).