{"record":{"id":"2f535d6ff4f2f447","repo":"GoogleContainerTools/jib","slug":"failed-get-authentication-method-from-www-authent","errorCode":null,"errorMessage":"Failed get authentication method from 'WWW-Authenticate' header","messagePattern":"Failed get authentication method from 'WWW-Authenticate' header","errorType":"http","errorClass":"RegistryErrorException","httpStatus":401,"severity":"error","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/registry/AuthenticationMethodRetriever.java","lineNumber":109,"sourceCode":"    if (responseException.getStatusCode() != HttpStatusCodes.STATUS_CODE_UNAUTHORIZED) {\n      throw responseException;\n    }\n\n    // Checks if the 'WWW-Authenticate' header is present.\n    String authenticationMethod = responseException.getHeaders().getAuthenticate();\n    if (authenticationMethod == null) {\n      throw new RegistryErrorExceptionBuilder(getActionDescription(), responseException)\n          .addReason(\"'WWW-Authenticate' header not found\")\n          .build();\n    }\n\n    // Parses the header to retrieve the components.\n    try {\n      return RegistryAuthenticator.fromAuthenticationMethod(\n          authenticationMethod, registryEndpointRequestProperties, userAgent, httpClient);\n\n    } catch (RegistryAuthenticationFailedException ex) {\n      throw new RegistryErrorExceptionBuilder(getActionDescription(), ex)\n          .addReason(\"Failed get authentication method from 'WWW-Authenticate' header\")\n          .build();\n    }\n  }\n}\n","sourceCodeStart":91,"sourceCodeEnd":115,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/registry/AuthenticationMethodRetriever.java#L91-L115","documentation":"Built by AuthenticationMethodRetriever.handleHttpResponseException when RegistryAuthenticator.fromAuthenticationMethod fails to parse the WWW-Authenticate header or fetch the token, throwing RegistryAuthenticationFailedException. Jib wraps it as RegistryErrorException with this reason, meaning the challenge header was present but could not be turned into a working authenticator.","triggerScenarios":"A malformed WWW-Authenticate header (bad realm URL, unsupported scheme), an unreachable token service realm, or TLS/network errors while calling the auth endpoint.","commonSituations":"Registries behind misconfigured OAuth/token servers, self-signed certs on the auth realm, private registries (Artifactory/Harbor/Nexus) emitting nonstandard challenges, or firewalled token endpoints.","solutions":["Inspect the WWW-Authenticate header (curl -v) and verify the realm URL is reachable from your machine.","Import the auth server's TLS certificate into the truststore if it uses a private/self-signed CA.","Confirm credentials are correct via `docker login`; expired or wrong creds often break token exchange.","Check registry (Harbor/Artifactory/Nexus) auth configuration so it emits a standard Bearer challenge with a valid realm."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// preflight: token endpoint reachability\n// realm=$(curl -sv https://registry.example.com/v2/ 2>&1 | grep -oP 'realm=\"\\K[^\"]+')\n// curl -sI \"$realm?service=registry.example.com\" — should be reachable and return a challenge response","typeGuard":null,"tryCatchPattern":"// catch and diagnose token exchange failures\ntry {\n    jibContainerBuilder.containerize();\n} catch (RegistryErrorException e) {\n    if (e.getMessage().contains(\"Failed get authentication method\")) {\n        throw new IllegalStateException(\"Could not authenticate with the registry's token service — verify realm reachability, TLS trust, and credentials\", e);\n    }\n    throw e;\n}","preventionTips":["Ensure the auth realm URL in WWW-Authenticate is reachable from your build environment.","Install private CA certificates into the JVM truststore for self-hosted registries.","Keep credentials fresh (`docker login`) and confirm registry auth (Harbor/Artifactory/Nexus) emits standard Bearer challenges."],"tags":["docker-registry","authentication","oauth","token"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}