********************
Client configuration
********************

The Anaconda Client gives you the ability to upload packages to your on-site Anaconda repository and provides highly granular access control capabilities.  Here is how to configure your client to use your local repository instead of Anaconda Cloud.

Anaconda client configuration
=============================

On each machine that will access your on-site Anaconda repository, run this command as the machine's local user::

	anaconda config --set url http://your.server.name:<port>/api

Or to set the default repo on a system wide basis, run this command::

    anaconda config --set url http://your.server.name:<port>/api --site

The system level config file will only be used if no user level config file is present.

To show the system and user config file locations and configuration settings::

    anaconda config --show

Conda configuration
===================

With the above anaconda config steps you can access all packages and channels from the local onsite Anaconda 
repository instead of the public Anaconda.org.

Users can then add individual accounts to their .condarc file by running the following command::

	conda config --add channels USERNAME

If you still wish to access certain channels from the public Anaconda.org::

        conda config --add channels http://conda.anaconda.org/<USERNAME>

Conda channel priority
----------------------

To set a preferred priority for the channels conda will search for package installs edit your ~/.condarc file and change the order. Channels at the top are searched first.

For example::

  channels:
    - channel
    - https://conda.anaconda.org/t/<token>/<channel2>
    - http://conda.anaconda.org/<channel1>
    - defaults

The order of search is now

#. private onsite Anaconda repository channel
#. private Anaconda.org channel2
#. public Anaconda.org channel1
#. default channel on onsite Anaconda repository


pip configuration
=================

To install pypi packages from your Anaconda repository, add your channel to your ~/.pip/pip.conf configuration file.

Edit the file and add an extra-index-url entry to the global config section::

    [global]
    extra-index-url = http://your.server.name:<port>/pypi/<username>/simple

Kerberos
========

If you have enabled Kerberos authentication as described in the :doc:`advanced`
installation guide, your browser and anaconda-client should be able to authenticate
to Anaconda repository using Kerberos.

In OS X/Unix, configure the file ``/etc/krb5.conf``::

    [libdefaults]
    default_realm = YOUR.DOMAIN

    [realms]
    YOUR.DOMAIN = {
      kdc = your.kdc.server
    }

    [domain_realm]
    your.anaconda.server = YOUR.DOMAIN

If your configuration is correct, you should be able to authenticate using the command-line
tool ``kinit``::

    kinit jsmith
    anaconda login


Browser Setup
-------------

Many browsers do not present your Kerberos credentials by default, to prevent
leaking credentials to untrusted parties. In order to use Kerberos authentication,
you must white-list Anaconda repository as a trusted party to receive credentials.

You must restart your browser after configuring the whitelist in order for
changes to be reflected.

Safari
^^^^^^

Safari requires no configuration - it will automatically present your
credentials without white-listing.

Chrome
^^^^^^

The ``AuthServerWhitelist`` policy must be set to ``your.anaconda.server`` -
this will allow Chrome to present credentials to Anaconda Repository with
the hostname ``your.anaconda.server``.
Depending on your DNS configuration, `DisableAuthNegotiateCnameLookup` may also be required - 
this will prevent Chrome from canonicalizing the hostname before generating a
service name.

To configure on OS X::

    defaults write com.google.Chrome AuthServerWhitelist "your.anaconda.server"

On Linux::

    mkdir -p /etc/opt/chrome/policies/managed
    mkdir -p /etc/opt/chrome/policies/recommended
    chmod -w /etc/opt/chrome/policies/managed
    echo '{"AuthServerWhitelist": "your.anaconda.server"}' > /etc/opt/chrome/policies/managed/anaconda_repo_policy.json

On Windows, use Group Policy objects to set the "Authentication server
whitelist" setting to "your.anaconda.server".

For more information, see Chrome's `SPNEGO authentication <http://www.chromium.org/developers/design-documents/http-authentication>`_
and `administration <https://www.chromium.org/administrators>`_ documentation.


Firefox
^^^^^^^

* Navigate to the configuration page ``about:config``
* Search for "negotiate"
* Set the configuration item ``network.negotiate-auth.trusted-uris`` to ``your.anaconda.server``

Internet Explorer
^^^^^^^^^^^^^^^^^

* Open the menu item *Internet Options > Tools > Advanced Tab*
* In the *Security* section, select "Enable Integrated Windows Authentication"

.. https://ping.force.com/Support/PingFederate/Integrations/How-to-configure-supported-browsers-for-Kerberos-NTLM
