# Knife-windows - Correct way to set auth proxy settings

**URL:** <https://discourse.chef.io/t/knife-windows-correct-way-to-set-auth-proxy-settings/8674>\
**Category:** Chef Infra (archive)\
**Created:** [June 12, 2016, 7:35pm UTC](https://discourse.chef.io/t/knife-windows-correct-way-to-set-auth-proxy-settings/8674 "2016-06-12T19:35:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rayterrill](https://avatars.discourse-cdn.com/v4/letter/r/65b543/32.png) [@rayterrill](https://discourse.chef.io/u/rayterrill)\
**Post date:** [June 12, 2016, 7:35pm UTC](https://discourse.chef.io/t/knife-windows-correct-way-to-set-auth-proxy-settings/8674/1 "2016-06-12T19:35:49Z")

</div>

First off, I’m a Chef n00b, so any patience with Chef n00bery is much appreciated. Trying to get Chef Server and some Server 2012R2 machines going, and struggling mightily with our authenticated proxy.

I see the wget.ps1 file that’s created on-the-fly via knife-windows on our target VM, which is using System.Net.WebClient to make the web request to download the Chef agent. It looks like this is being generated from ~/.chefdk/gem/ruby/2.1.0/gems/knife-windows-1.4.1/lib/chef/knife/core/windows\_bootstrap\_context.rb. The Ruby code appears to be looking for the bootstrap\_proxy command line parameter, and if set it’s passing that information along to the wget.ps1 script.

In our environment, however, we need more than that - I need to set some authenticated user settings. What’s the best way to do that?

What I’ve done, which appears to work fairly well, is modify the windows\_bootstrap\_context.rb file to add the proxy settings (hardcoded for now, but I could abstract them as well):

```
win_wget_ps = <<-WGET_PS
param(
   [String] $remoteUrl,
   [String] $localPath
)

$ProxyUrl = $env:http_proxy;
$webClient = new-object System.Net.WebClient;

if ($ProxyUrl -ne '') {
  $WebProxy = New-Object System.Net.WebProxy($ProxyUrl,$true)
  $WebClient.Proxy = $WebProxy
}

$WebClient.Proxy.Credentials = New-Object System.Net.NetworkCredential("username","password","domain")

$webClient.DownloadFile($remoteUrl, $localPath);
WGET_PS

```

Same thing goes for the knife client file, which also is created by the same windows\_bootstrap\_context.rb script - I’ve added some additional code to set the auth user proxy settings there too:

```
  if knife_config[:bootstrap_proxy]
    client_rb << "\n"
    client_rb << %Q{http_proxy "#{knife_config[:bootstrap_proxy]}"\n}
    client_rb << %Q{http_proxy_user 'username'\n}
    client_rb << %Q{http_proxy_pass 'password'\n}
    client_rb << %Q{https_proxy "#{knife_config[:bootstrap_proxy]}"\n}
    client_rb << %Q{https_proxy_user 'username'\n}
    client_rb << %Q{https_proxy_pass 'password'\n}
    client_rb << %Q{no_proxy "#{knife_config[:bootstrap_no_proxy]}"\n} if knife_config[:bootstrap_no_proxy]
  end

```

Any help would be very much appreciated.

---

<div class="post-metadata">

**Author:** ![Steven\_Murawski](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/steven_murawski/32/1450_2.png) [@Steven\_Murawski](https://discourse.chef.io/u/Steven_Murawski)\
**Post date:** [June 14, 2016, 5:24pm UTC](https://discourse.chef.io/t/knife-windows-correct-way-to-set-auth-proxy-settings/8674/2 "2016-06-14T17:24:53Z")

</div>

One of the easier ways to get around the proxy craziness is to stash the installer somewhere behind your firewall and use the `--msi-url <uri to where your installer is available>` to knife bootstrap. Then it won’t have to hit the internet to get the installer bits.

---

<div class="post-metadata">

**Author:** ![rayterrill](https://avatars.discourse-cdn.com/v4/letter/r/65b543/32.png) [@rayterrill](https://discourse.chef.io/u/rayterrill)\
**Post date:** [June 14, 2016, 5:57pm UTC](https://discourse.chef.io/t/knife-windows-correct-way-to-set-auth-proxy-settings/8674/3 "2016-06-14T17:57:45Z")

</div>

Brilliant! I reverted my windows\_bootstrap\_context.rb to no longer have my proxy settings and used the --msi-url to hit a web-hosted version of the msi in our network - worked perfectly (and much cleaner).

Our authenticated (AD-based) proxy is the bane of my IT existence, especially with any kind of web-based automation. 😡

Is that msi-url parameter documented anywhere? I couldn’t find it in the knife-bootstrap or knife-windows documentation anywhere. Super useful.

Thanks Steven!

---

<div class="post-metadata">

**Author:** ![Steven\_Murawski](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/steven_murawski/32/1450_2.png) [@Steven\_Murawski](https://discourse.chef.io/u/Steven_Murawski)\
**Post date:** [June 14, 2016, 5:59pm UTC](https://discourse.chef.io/t/knife-windows-correct-way-to-set-auth-proxy-settings/8674/4 "2016-06-14T17:59:13Z")

</div>

@rayterrill I’m not sure if it’s documented anywhere off-hand. I remember the PR going in to knife-windows and `knife bootstrap windows winrm --help` confirmed it was there for me.

---

<div class="post-metadata">

**Author:** ![rayterrill](https://avatars.discourse-cdn.com/v4/letter/r/65b543/32.png) [@rayterrill](https://discourse.chef.io/u/rayterrill)\
**Post date:** [June 14, 2016, 6:22pm UTC](https://discourse.chef.io/t/knife-windows-correct-way-to-set-auth-proxy-settings/8674/5 "2016-06-14T18:22:19Z")

</div>

@Steven_Murawski All good. Thanks so much Steven! 🙂