Anaconda Enterprise: Documentation

# Configuring Anaconda Client

- Client configuration
- Conda configuration
- Pip configuration
- Kerberos configuration

Anaconda Client gives you the ability to upload packages to your on-site Anaconda Repository and provides highly granular access control capabilities. The instructions below describe how to configure Client to use your local Repository instead of Anaconda Cloud.

## Client configuration

On each machine that accesses your on-site Repository, run this command as the machine’s local user:

    anaconda config --set url http://your.server.name:<port>/api

Or, to set the default repo on a system-wide basis, run this command:

    anaconda config --set url http://your.server.name:<port>/api --site

NOTE: Replace `your.server.name` with the name of your local Repository and `<port>` with the name of the port used by Repository.

The system level `config` file is used only if no user-level `config` file is present.

To show the system and user `config` file locations and configuration settings:

    anaconda config --show

## Conda configuration

When the above `anaconda config` steps are completed, you can access all packages and channels from the local on-site Repository instead of the public Anaconda.org.

Users can then add individual accounts to their `.condarc` file by running the following command:

    conda config --add channels USERNAME

If you still want to access certain channels from the public Anaconda.org, run:

    conda config --add channels http://conda.anaconda.org/USERNAME

NOTE: Replace `USERNAME` with your username.

### Conda channel priority

To set a preferred priority for the channels conda searches for package installs, edit your `~/.condarc file` and change the order. Channels at the top are searched first.

For example:

    channels:
      - channel
      - https://conda.anaconda.org/t/<token>/<channel2>
      - http://conda.anaconda.org/<channel1>
      - defaults

The order of search is:

1. Private on-site Repository channel.
2. Private Anaconda.org channel2.
3. Public Anaconda.org channel1.
4. Default channel on the on-site Repository.

## Pip configuration

To install PyPI packages from your Repository, add your channel to your `~/.pip/pip.conf` configuration file.

Edit the file and add an extra-index-url entry to the global config section:

    [global]
    extra-index-url = http://your.server.name:<port>/pypi/USERNAME/simple

NOTE: Replace `your.server.name` with the name of your local Repository, `<port>` with the name of the port used by Repository and `USERNAME` with your username.

## Kerberos configuration

If you have enabled Kerberos authentication as described in Configuring Repository to use Kerberos, your browser and Client should be able to authenticate to Repository using Kerberos.

In macOS/Unix, configure the file `/etc/krb5.conf`:

    [libdefaults]
    default_realm = YOUR.DOMAIN

    [realms]
    YOUR.DOMAIN = {
      kdc = your.kdc.server
    }

    [domain_realm]
    your.anaconda.repository = YOUR.DOMAIN

NOTE: Replace `YOUR.DOMAIN` with your domain, `your.kdc.server` with your Kerberos key distribution center (KDC) and `your.anaconda.repository` with your local Repository server.

If your configuration is correct, you should be able to authenticate using the command line tool `kinit`:

    kinit jsmith
    anaconda login

NOTE: Replace `jsmith` with your username.

### Browser Setup

Many browsers do not present your Kerberos credentials by default, to prevent leaking credentials to untrusted parties. In order to use Kerberos authentication, you must whitelist Repository as a trusted party to receive credentials.

You must restart your browser after configuring the whitelist in order for changes to be reflected.

#### Safari

Safari requires no configuration—it automatically presents your credentials without whitelisting.

#### Chrome

The AuthServerWhitelist policy must be set to `your.anaconda.repository` to allow Chrome to present credentials to Repository with the hostname `your.anaconda.repository`. Depending on your DNS configuration, DisableAuthNegotiateCnameLookup may also be required to prevent Chrome from canonicalizing the hostname before generating a service name.

NOTE: Replace `your.anaconda.repository` with your local Repository server.

To configure on macOS:

    defaults write com.google.Chrome AuthServerWhitelist "your.anaconda.repository"

On Linux:

    mkdir -p /etc/opt/chrome/policies/managed
    mkdir -p /etc/opt/chrome/policies/recommended
    chmod -w /etc/opt/chrome/policies/managed
    echo '{"AuthServerWhitelist": "your.anaconda.repository"}' > /etc/opt/chrome/policies/managed/anaconda_repo_policy.json

On Windows, use Group Policy objects to set the Authentication server whitelist setting to `your.anaconda.repository`.

For more information, see Chrome’s SPNEGO authentication and administration documentation.

#### Firefox

1. Navigate to the configuration page `about:config`.
2. Search for `negotiate`.
3. Set the configuration item `network.negotiate-auth.trusted-uris` to `your.anaconda.repository`

NOTE: Replace `your.anaconda.repository` with your local Repository server.

#### Internet Explorer

1. In the Tools menu, select Internet Options.
2. On the Advanced tab, in the Security section, select Enable Integrated Windows Authentication.