search

cesanta / docker_auth

Authentication server for Docker Registry 2
Apache License 2.0
1.28k stars 305 forks source link

Authentication via certificates #300

Open logan064 opened 3 years ago

logan064 commented 3 years ago

Is there a way to authenticate using docker_auth via client certificates instead of username/password?

All of the information uses a username password combo instead of client certificates.

techknowlogick commented 3 years ago

Not possible currently, however I'm interested if you have an example from another provider including how to log in w/ docker (or other compatible OCI client) as all I can find is some vague examples w/ nginx

logan064 commented 3 years ago

Currently the docker registry server's config.yml allows you to specify clientcas to give trusted CAs. This allows only clients that have a client certificate in /etc/containers/certs.d/localhost:5000 that is signed by a a trusted CA. You can substitute the localhost:5000 with the endpoint of your registry, obviously. This works great, but does not allow the ACLs to be applied. I am using podman 2.2.1, but I know docker has a similar capability. Is there any way to piggy back off of the client certificates in the certs.d subdirectories?

rojer commented 3 years ago

we could retrieve attributes of the client cert and add them to labels so authz phase could access them

logan064 commented 3 years ago

Is authz the authorization phase, i.e. ACL?

Could the CN be treated as account and O as the group? That is similar to what kuberenetes does with their certificates.

rojer commented 3 years ago

yes, authz is the authorization / ACL matching phase, authn (authentication) in this case is the TLS handshake. i don't think we should be statically rewriting CN to account, just stuff attributes into labels and let the user (of docker auth, i.e. the admin) express rules based on them in the ACL entries themselves.

rojer commented 3 years ago

so, e.g. CN value will be put into TLS_CN, O into TLS_O, etc.

logan064 commented 3 years ago

That sounds good!

rojer commented 3 years ago

TLS certificate can be accessed via the http.Request.TLS.PeerCertificates field. we only need to examine the first entry of the slice, which is the client certificate itself, the rest (if any) are the intermediate CA certs.