Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix connecting to registries with non-hardcoded auth scopes #1478

Closed
mtrmac opened this issue Feb 23, 2022 · 1 comment · Fixed by #1640
Closed

Fix connecting to registries with non-hardcoded auth scopes #1478

mtrmac opened this issue Feb 23, 2022 · 1 comment · Fixed by #1640

Comments

@mtrmac
Copy link
Collaborator

mtrmac commented Feb 23, 2022

See #1079 for a PR.
@mtrmac mtrmac mentioned this issue Feb 23, 2022
Closed
@mtrmac mtrmac changed the title Fix connecting to registries with non-presumed auth scopes Fix connecting to registries with non-hardcoded auth scopes Feb 23, 2022
@mtrmac mtrmac mentioned this issue Mar 12, 2022
Closed
@vrothberg vrothberg mentioned this issue Mar 31, 2022
Closed
@rhatdan
Copy link
Member

rhatdan commented May 2, 2022

What is going on with this issue?

@dcermak dcermak mentioned this issue Aug 25, 2022
Merged
dcermak pushed a commit to dcermak/image that referenced this issue Aug 25, 2022
@dcermak
docker_client: Handle "invalid_scope" errors
ac2ca5d 
By default docker_client just uses the auth challenges from the /v2/
ping request to request a Bearer Token. For some requests (e.g. for
/v2/_catalog on some registries) this might not be sufficient and return a
a HTTP Unauthorized Error with the "www-authenticate" header including
an "insufficient_scope" error. In that case the client will now retry
the request and fetch a new token with updated challenges to have the
"scope" matching for what the endpoint needs.

This fixes containers#1478

Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Dan Čermák <[email protected]>
dcermak pushed a commit to dcermak/image that referenced this issue Aug 26, 2022
@dcermak
docker_client: Handle "invalid_scope" errors
08cd8ec 
By default docker_client just uses the auth challenges from the /v2/
ping request to request a Bearer Token. For some requests (e.g. for
/v2/_catalog on some registries) this might not be sufficient and return a
a HTTP Unauthorized Error with the "www-authenticate" header including
an "insufficient_scope" error. In that case the client will now retry
the request and fetch a new token with updated challenges to have the
"scope" matching for what the endpoint needs.

This fixes containers#1478

Co-authored-by: Miloslav Trmač <[email protected]>

Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Dan Čermák <[email protected]>
Signed-off-by: Miloslav Trmač <[email protected]>
dcermak pushed a commit to dcermak/image that referenced this issue Aug 26, 2022
@mtrmac @dcermak
docker_client: Handle "invalid_scope" errors
1e05f27 
By default docker_client just uses the auth challenges from the /v2/
ping request to request a Bearer Token. For some requests (e.g. for
/v2/_catalog on some registries) this might not be sufficient and return a
a HTTP Unauthorized Error with the "www-authenticate" header including
an "insufficient_scope" error. In that case the client will now retry
the request and fetch a new token with updated challenges to have the
"scope" matching for what the endpoint needs.

This fixes containers#1478

Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Dan Čermák <[email protected]>
Signed-off-by: Miloslav Trmač <[email protected]>

Co-authored-by: Miloslav Trmač <[email protected]>
dcermak pushed a commit to dcermak/image that referenced this issue Aug 26, 2022
@mtrmac @rhafer @dcermak
docker_client: Handle "invalid_scope" errors
12b2398 
By default docker_client just uses the auth challenges from the /v2/
ping request to request a Bearer Token. For some requests (e.g. for
/v2/_catalog on some registries) this might not be sufficient and return a
a HTTP Unauthorized Error with the "www-authenticate" header including
an "insufficient_scope" error. In that case the client will now retry
the request and fetch a new token with updated challenges to have the
"scope" matching for what the endpoint needs.

This fixes containers#1478

Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Dan Čermák <[email protected]>
Signed-off-by: Miloslav Trmač <[email protected]>

Co-authored-by: Miloslav Trmač <[email protected]>
Co-authored-by: Ralf Haferkamp <[email protected]>
dcermak pushed a commit to dcermak/image that referenced this issue Aug 29, 2022
@mtrmac @rhafer @dcermak
docker_client: Handle "invalid_scope" errors
2fd3305 
By default docker_client just uses the auth challenges from the /v2/
ping request to request a Bearer Token. For some requests (e.g. for
/v2/_catalog on some registries) this might not be sufficient and return a
a HTTP Unauthorized Error with the "www-authenticate" header including
an "insufficient_scope" error. In that case the client will now retry
the request and fetch a new token with updated challenges to have the
"scope" matching for what the endpoint needs.

This fixes containers#1478

Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Dan Čermák <[email protected]>
Signed-off-by: Miloslav Trmač <[email protected]>

Co-authored-by: Miloslav Trmač <[email protected]>
Co-authored-by: Ralf Haferkamp <[email protected]>
dcermak pushed a commit to dcermak/image that referenced this issue Aug 30, 2022
@mtrmac @rhafer @dcermak
docker_client: Handle "invalid_scope" errors
3ce7f05 
By default docker_client just uses the auth challenges from the /v2/
ping request to request a Bearer Token. For some requests (e.g. for
/v2/_catalog on some registries) this might not be sufficient and return a
a HTTP Unauthorized Error with the "www-authenticate" header including
an "insufficient_scope" error. In that case the client will now retry
the request and fetch a new token with updated challenges to have the
"scope" matching for what the endpoint needs.

This fixes containers#1478

Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Ralf Haferkamp <[email protected]>
Signed-off-by: Dan Čermák <[email protected]>
Signed-off-by: Miloslav Trmač <[email protected]>

Co-authored-by: Miloslav Trmač <[email protected]>
Co-authored-by: Ralf Haferkamp <[email protected]>
@mtrmac mtrmac mentioned this issue Dec 9, 2022
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

docker_client: Handle "invalid_scope" errors dcermak/image
2 participants
@rhatdan @mtrmac