Use ELPA (Emacs) behind a proxy requiring authentication

Question

I have read this and this question. In both they say Emacs can deal with authentication, but it does not work for me.

The question is: What is wrong?

The Emacs version is 24.0.97-1, and it is running on 64-bit Linux.

At work I have to use proxy server for any Internet connection. So I set the following environment variables:

http_proxy="http://username:password@ip:port"
https_proxy="https://username:password@ip:port"
ftp_proxy="ftp://username:password@ip:port"

This works and I can download packages without any problem.

When I run M-x package-refresh-contents in Emacs it asks me for login and password for the proxy server, but it can not connect to the server. It even does not try to connect, i.e. after I type password and press Enter Emacs instantly reports: Failed to download 'marmalade' archive

The same happens if I remove username and password from http_proxy variable or if I set url-proxy-services in Emacs (even if I unset the system variable).

Answer 1

It looks like Emacs has some troubles with authentication. So I have installed Squid and now use it as an intermediate between the external proxy server and all my applications. Squid is configured as a proxy without authentication and everything works well with it.

Many people recommend this solution but give no precise instructions. I made my /etc/squid/squid.conf from another one designed for different purpose. Probably it contains something that is not needed and/or misses something it should have. Any improvements are welcome:

# only access from localhost is allowed
acl localhost src 127.0.0.1/32
acl all src all
http_access allow localhost
http_access deny all
icp_access deny all

never_direct allow all

# turn off cache
cache_dir null /tmp
cache deny all

# logs
access_log /var/log/squid/access.log squid

# turn off proxy-headers (no idea what is it :))
via off
forwarded_for off

# describe external proxy server
cache_peer <proxy_ip> parent <proxy_port> 0 no-query default proxy-only login=<my_login>:<my_password>
http_port 10000
acl port10000 myport 10000
cache_peer_access <proxy_ip> allow port10000

This proxy has address 127.0.0.1:10000. In Emacs I have to execute the following code:

(setq url-proxy-services '(("http" . "127.0.0.1:10000")))

Answer 2

There are two bugs here - one is in url-http.el, and can be fixed with a patch I just sent to http://debbugs.gnu.org/cgi/bugreport.cgi?bug=12069 This will stop Emacs from prompting you for the password on every attempt, and when it doesn't prompt you, it should work.

The other bug hasn't been tracked down yet, but it seems that when the proxy server requests authentication, the authentication is prompted for, then immediately the authentication request from the proxy server is processed by the package code. Meanwhile the real request continues in the background.

Answer 3

Emacs uses only HOST and PORT part from http_proxy.

I get authorization working without user interaction by:

(setq url-proxy-services
   '(("no_proxy" . "^\\(localhost\\|10.*\\)")
     ("http" . "proxy.com:8080")
     ("https" . "proxy.com:8080")))

(setq url-http-proxy-basic-auth-storage
    (list (list "proxy.com:8080"
                (cons "Input your LDAP UID !"
                      (base64-encode-string "LOGIN:PASSWORD")))))

This works for Emacs 24.3. It is based on non-public API tricks, so might not work is another Emacs versions...

Replace LOGIN and PASSWORD with your auth info...

Also there is url-http-proxy-digest-auth-storage. Just fill prompt with authentication data and check which var used by Emacs (by M-: var RET)...

Answer 4

There is another related bug in emacs < 28.1 in url-http with the function url-https-proxy-connect, causing all https calls through an authenticating proxy to fail.

See https://debbugs.gnu.org/cgi/bugreport.cgi?bug=42422.

As a workaround for emacs < 28.1, override the function with the fixed version:

(with-eval-after-load 'url-http
  (defun url-https-proxy-connect (connection)
    (setq url-http-after-change-function 'url-https-proxy-after-change-function)
    (process-send-string connection (format (concat "CONNECT %s:%d HTTP/1.1\r\n"
                            "Host: %s\r\n"
                            (let ((proxy-auth (let ((url-basic-auth-storage
                                         'url-http-proxy-basic-auth-storage))
                                    (url-get-authentication url-http-proxy nil 'any nil))))
                              (if proxy-auth (concat "Proxy-Authorization: " proxy-auth "\r\n")))
                            "\r\n")
                        (url-host url-current-object)
                        (or (url-port url-current-object)
                        url-https-default-port)
                        (url-host url-current-object)))))