Nexus Repository 2 Security Cookbook

Visit my.sonatype.com for documentation on Nexus Repository version 2.

This article describes how to set up some commonly requested Nexus Repository 2 security configurations.

Can I make a repository private without disabling anonymous access?

Yes. You will need to change the roles around a bit.

Note: Assigning access to a group is equivalent to assigning these privileges to all of the repositories in the group.

1. Create a new Privilege that gives access to your public group (or individual repositories)

1. Log in to Nexus Repository 2 as an administrator.
2. Click on Privileges in the left menu.
3. Click Add.
4. Use the following values:
   • Name: M2 Public Repositories (Group)
   • Description: Access to Public Repositories (Group)
   • Repository: Public Repositories (Group)
   • Repository Target: All (Maven2)
5. Repeat the previous step for all your public groups and/or respositories.
6. Save.

2. Create a new Role and assign this new privilege to it.

   1. Click on Roles in the left menu.
   2. Click Add.
   3. User the following values:
      • Role Id: repo-public-read
      • Name: Repo: All Public Repositories (read)
      • Description: Read only access to all public repositories.
      • Selected Roles / Privileges: M2 Public Repositories (Group) - (read)
   4. Include all of the group/repo privd you created in the first step.
   5. Save.

3. Remove the Grant Read all role from the Anonymous user and add the new role.

   1. Click on Users in the left menu.
   2. Click on the anonymous user.
   3. Remove the role ‘Repo: All Repositories (read)’
   4. Add the role ‘All Public Repositories (read)’
   5. You may need to create other Privileges to grant users access to your private repositories
   6. Save.

How do I disable artifact redeployment against a hosted repo.

Important: The steps below are valid, but all current versions of Nexus Repository 2 have a "deployment policy" setting in the hosted repository configuration. Setting this to "disable redeploy" will accomplish the same thing as the steps below and is the preferred approach.

1. Create a new deployment role that does not have an update privilege but has the privilege to update Metadata.

   1. Create a new Privilege that gives access Maven 2 Metadata
   2. Login to Nexus Repository 2 as an administrator.
   3. Click on Privileges in the left menu.
   4. Click Add. Use the following values:
      • Name: All M2 Repositories Metadata
      • Description: All M2 Repositories Metadata
      • Repository: All Repositories
      • Repository Target: All Metadata (Maven2)
   5. Save.

2. Create a new Deployment Role.

   1. Click on Roles in the left menu.
   2. Click Add.
   3. User the following values:
   4. Role Id: repo-custom-deploy
   5. Name: Repo: All Repositories (no update)
   6. Description: Allows deployment to all M2 Repositores, but does not allow overwriting artifacts.
   7. Selected Roles / Privileges: All Metadata (Maven2) - (update), Nexus Anonymous Role, All M2 Repositories - (create), All M2 Repositories - (read), All M2 Repositories - (delete). Adding delete is optional.
   8. Save.

3. Replace the roles assigned to the deployment user.

   1. Click on Users in the left menu.
   2. Click on the deployment user.
   3. Remove the roles ‘Repo: All Repositories (Full Control)’ and ‘Nexus Deployment Role’
   4. Add the role ‘Repo: All Repositories (no update)’
   5. Save.