github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Allow empty scope authorization

Browse Source 
Registries may allow using token authorization without
explicitly setting the scope. This may cover use cases where
no scope is required for an endpoint or the registry is only
covering authentication using the token. This aligns with the
oauth2 spec which specifies the scope as optional.

Signed-off-by: Derek McGowan <derek@mcgstyle.net>
This commit is contained in:
Derek McGowan 2019-12-12 11:02:25 -08:00
parent 55698e6942
commit 08517e5864
No known key found for this signature in database
GPG Key ID: F58C5D0A4405ACDB
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
remotes/docker/authorizer.go
View File

@ -196,10 +196,11 @@ func (a *dockerAuthorizer) generateTokenOptions(ctx context.Context, host string
} }
scope, ok := c.parameters["scope"] scope, ok := c.parameters["scope"]
if !ok { if ok {
return tokenOptions{}, errors.Errorf("no scope specified for token auth challenge") to.scopes = append(to.scopes, scope)
} else {
log.G(ctx).WithField("host", host).Debug("no scope specified for token auth challenge")
} }
to.scopes = append(to.scopes, scope)
if a.credentials != nil { if a.credentials != nil {
to.username, to.secret, err = a.credentials(host) to.username, to.secret, err = a.credentials(host)
@ -273,9 +274,6 @@ func (ah *authHandler) doBearerAuth(ctx context.Context) (string, error) {
to := ah.common to := ah.common
to.scopes = getTokenScopes(ctx, to.scopes) to.scopes = getTokenScopes(ctx, to.scopes)
if len(to.scopes) == 0 {
return "", errors.Errorf("no scope specified for token auth challenge")
}
// Docs: https://docs.docker.com/registry/spec/auth/scope // Docs: https://docs.docker.com/registry/spec/auth/scope
scoped := strings.Join(to.scopes, " ") scoped := strings.Join(to.scopes, " ")
@ -332,7 +330,9 @@ type postTokenResponse struct {
func (ah *authHandler) fetchTokenWithOAuth(ctx context.Context, to tokenOptions) (string, error) { func (ah *authHandler) fetchTokenWithOAuth(ctx context.Context, to tokenOptions) (string, error) {
form := url.Values{} form := url.Values{}
form.Set("scope", strings.Join(to.scopes, " ")) if len(to.scopes) > 0 {
form.Set("scope", strings.Join(to.scopes, " "))
}
form.Set("service", to.service) form.Set("service", to.service)
// TODO: Allow setting client_id // TODO: Allow setting client_id
form.Set("client_id", "containerd-client") form.Set("client_id", "containerd-client")