Maven: Use configured server credentials

When "mvn org.owasp:dependency-check-maven:3.3.1:check" command is run an error appears:

[ERROR] IO Exception connecting to https://artifactory/2.0/nvdcve-2.0-2004.xml.gz: HEAD request returned a non-200 status code: https://artifactory/2.0/nvdcve-2.0-2004.xml.gz
[DEBUG] Exception details
org.owasp.dependencycheck.utils.DownloadFailedException: **HEAD request returned a non-200 status** code: https://artifactory/2.0/nvdcve-2.0-2004.xml.gz
at org.owasp.dependencycheck.utils.Downloader.getLastModified(Downloader.java:273)
at org.owasp.dependencycheck.utils.Downloader.getLastModified(Downloader.java:235)
at org.owasp.dependencycheck.data.update.NvdCveUpdater$TimestampRetriever.call(NvdCveUpdater.java:512)
at org.owasp.dependencycheck.data.update.NvdCveUpdater$TimestampRetriever.call(NvdCveUpdater.java:485)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

We are using internal mirroring of CVE in the pom.xml configuration and is as follows:

org.owasp
dependency-check-maven
3.3.1

https://artifactory/nvdcve-Modified.xml.gz
https://artifactory/2.0/nvdcve-2.0-Modified.xml.gz
https://artifactory/nvdcve-%d.xml.gz
https://artifactory/artifactory/2.0/nvdcve-2.0-%d.xml.gz




check

Besides, every artifactory url exists and in settings.xml an id for server also was provided but the error is still appearing.

Apart from that, we also try:

$ mvn org.owasp:dependency-check-maven:3.3.1:check -Ddownloader.quick.query.timestamp=false

but for GET request same error is obtained " GET request returned a non-200 status code" and artifactory administrators told us that a 401 error is returned but as I explained before in the settings an id server with user and password was provided.

Can you help up?

Thanks in advance!

Start by reproducing the Maven goal with the configured settings.xml and compare the 401 response with the plugin's Downloader.getLastModified and NvdCveUpdater timestamp path shown in the stack trace. Trace how the Maven plugin receives server configuration and verify that HEAD and GET requests use the configured credentials; done means authenticated Artifactory URLs no longer return 401.

Written by the indexing model from the issue text.