Credentials ignored with maven scmchangelog-plugin

Question

When I configure the scmchangelog-plugin, as written in the examples/tutorial, and run the site-generation, the username and password I have set are ignored.

The documentation says that username and password which should be used to access the SCM can be configured in the plugin-configuration. This looks like this:

<reporting>
 <plugins>
  <plugin> 
   <groupId>org.codehaus.mojo</groupId>
   <artifactId>scmchangelog-maven-plugin</artifactId>
   <version>1.3</version>
   <configuration>
    <grammar>REMY</grammar>
    <connectionUrl>scm:svn:svn+ssh://repo.lan/repo/project/trunk</connectionUrl>
    <username>user</username>
    <password>password</password>
   </configuration>
  </plugin>
 </plugins>
</reporting>

When i run the site-generation (mvn site), the output on the commandline says

[INFO] Executing: /bin/sh -c cd /tmp && svn --username user --password '*****' 
--non-interactive list --xml svn+ssh://repo.lan/repo/project/tags/

But I'm still prompted for the the password and the user used to access the SCM is the one running the mvn command.

Any ideas what could be wrong?

Update:

I tracked down the problem to the svn command line client now.

the problem is, that when i run a command like the following

svn list --username foo --password bar --non-interactive svn+ssh://host/repo/project

the command line tool seems to ignore the given options. i'm still questioned for a password, and the user used to access the URL is the one who executes the command, and not the one set in the options.

i'm using svn version 1.4.6 here.

any ideas what might go wrong here ?

Answer 1

This is a known bug. The correct behavior would be to show an error that states that the --username and --password options are not supported when using an external authentication mechanism like SSH, instead of silently ignoring those options.

To fix your issue, pass your 'foo' username as part of the URL:

svn+ssh://foo@host/repo/project

and use something like ssh-agent to cache your credentials, thus avoiding the password prompt.

Answer 2

Do you mean the scm:changelog goal of the Maven SCM plugin? If this is the case you have two choices to ensure the SCM is passed your credentials.

Preferred approach

Some SCM providers allow you to specify a settings file below M2_HOME/conf/.scm, for example Subversion's is svn-settings.xml and CVS's is cvs-settings.xml

Your SCM provider should define how to define the configuration settings. For Subversion I end up with a file like this:

<svn-settings>
  <user>[username]</user>
  <password>[password]</password>
</svn-settings>

If needed, you can specify the SCM settings file in another location by passing a command-line parameter to the file:

-Dmaven.scm.svn.config_directory=your_configuration_directory

Other approach

The other (undesirable) option is to configure the scm section of the POM so that the urls contain the username and password. The implementation of this is provider-specific, but is generally of a similar form to this example for Subversion:

scm:svn:http://[user]:[password]@host/path

So your scm section in the POM would look something like this:

<scm>
  <connection>scm:svn:http://[user]:[password]@host/path</connection>
  <developerConnection>
    scm:svn:http://[user]:[password]@host/path
  </developerConnection>
  <url>http://somerepository.com/viewsvn</url>
</scm>

This is obviously undesirable as your SCM credentials end up in your installed POM, you should really only use this for testing the connection in my opinion. For more information see the SCM URL Format page and details for specific SCM providers

Answer 3

Check if there's an alias clobbering your use of the "svn" command.

Also check if the destination host allows password-mode authentification. Might also be worth to check that the desktop doesn't fool around with some handy "keyring agent", those can interfere with svn+ssh.