ARTIFACTORY: How to Fix Access OIDC 401 Unauthorized Errors Caused by ~/.netrc Overrides

Summary

This article describes an issue where CI pipelines that create or update OIDC identity mappings may fail with HTTP 401 Unauthorized, even though OIDC token exchange continues to work successfully.

Issue

The pipeline is expected to call JFrog Access management APIs using a Bearer Access token obtained through OIDC token exchange. However, requests to the identity-mapping APIs return:

{
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "HTTP 401 Unauthorized",
      "detail": "Request has failed. Due to incorrect username/password or locked user."
    }
  ]
}

Affected endpoints include

• GET /access/api/v1/oidc/<provider>/identity_mappings*

• POST /access/api/v1/oidc/<provider>/identity_mappings*

Meanwhile, the OIDC token exchange endpoint (POST /access/api/v1/oidc/token) continues to succeed, and the same identity-mapping APIs work correctly when invoked with a valid Bearer token using the UI or curl.

Cause

This occurs due to the client authentication behavior rather than an issue with the JFrog platform.

A typical workflow is:

1. A setup step (such as create-pip-conf) may create a ~/.netrc file. If the file contains JFrog Basic credentials, Python package installation can use those credentials for authentication.

2. The pipeline later obtains an OIDC Access token.

3. The application uses Python's requests library to call the identity-mapping APIs.

4. Because ~/.netrc exists, requests automatically uses the Basic credentials from that file instead of the intended Bearer token.

5. JFrog Access rejects the Basic credentials, resulting in HTTP 401 Unauthorized. Repeated retries may temporarily suspend the user due to failed authentication attempts.

Root cause

A leftover ~/.netrc file causes Python's requests library to authenticate using Basic authentication instead of the intended Bearer Access token.

Resolution

Remove the ~/.netrc file after dependency installation and before making any JFrog Access API calls:

# After pip/poetry install completes
rm -f ~/.netrc

Then invoke the identity-mapping APIs using only the Bearer token:

Authorization: Bearer <ACCESS_TOKEN>

This ensures the requests are authenticated correctly and prevents HTTP 401 errors.