With Allow Anonymous access enabled globally, the P2 virtual repo does not return correct response to the Maven Tycho plugin requests.
Enable global anonymous access, because we want to be able to have Anonymous read to some of the other repo types. But in this case, the repos aggregated inside the P2 virtual repo do not have even Read permissions for the Anonymous user. With Global Anonymous enabled, Maven tycho plugin does not get a 401 response from Artifactory and without the 401 response, Maven will not send the creds for authentication. In this case, the compositeContent.xml file returned from P2 virtual does not have child locations as the Anonymous user is missing Read permissions to the aggregated repos.
The expected behavior is that, Artifactory should send a 401 response and this will allow Maven client to send the creds and authenticate.
With Global anonymous access disabled, the maven requests to P2 repo works as expected. This works as the maven sends anonymous request first and when it gets a 401 from Artifactory, it sends auth details and then the request to P2 virtual repo returns the compositeContent.xml with all the child locations.