Trouble getting refresh_token using OAuth2

I am following the documentation (https://github.com/distribution/distribution/blob/main/docs/spec/auth/oauth.md) to try and get a refresh_token when using the cesanta/docker_auth:1 image.

The request is this:

curl --location --request POST 'https://(company website):2087/auth' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=password' \
--data-urlencode 'service=company-token-service' \
--data-urlencode 'client_id=fooclient' \
--data-urlencode 'access_type=offline' \
--data-urlencode 'username=myuser' \
--data-urlencode 'password=mypwd'

and the response:

{
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjRCRzY6RjRQMjpPSFNJOlpESU46RzVENTpFQlIyOkkyRjQ6UDJJQTpCRklMOlRZRjI6M1JGUjpYRzZLIn0.eyJpc3MiOiJwZWZpLXRva2VuLWlzc3VlciIsInN1YiI6InBsZyIsImF1ZCI6InBlZmktdG9rZW4tc2VydmljZSIsImV4cCI6MTYyODA4NTc0NSwibmJmIjoxNjI4MDg0ODM1LCJpYXQiOjE2MjgwODQ4NDUsImp0aSI6Ijc2ODgyNTg3NDU2NTkwNDcyNzUiLCJhY2Nlc3MiOltdfQ.Qfp31vBooPIQT27Yl55bolbZbsY4RfOOYfkyoCPQqx8F6B2yX8flzq1byIAlkkcy7mKwvqUtF2DriiMd633MXLO_ZRfRE1rjE1BOZgA_lXPJ3Iz-5shMucYQY2Dxuq7gK2lnr-FGoB4YPNTFIxAnjDo2TQ4m4a0xTwhqvx_VC-chxgHzpQpOMyQSgCZ8Uvp0DxQd7Z4FfDx8dqKsU0ToGzA0Q2URzIacVQ8X27wFsNXacupAUDN59LCLHttLW90Ujb_dB5fHUXx3KkJffzw1paqeUmF3bxdFJgBk9cdboerCYSCImuDROkhHUTW3kt0TN_vXkzDu2TDrXayARw2oTg",
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IjRCRzY6RjRQMjpPSFNJOlpESU46RzVENTpFQlIyOkkyRjQ6UDJJQTpCRklMOlRZRjI6M1JGUjpYRzZLIn0.eyJpc3MiOiJwZWZpLXRva2VuLWlzc3VlciIsInN1YiI6InBsZyIsImF1ZCI6InBlZmktdG9rZW4tc2VydmljZSIsImV4cCI6MTYyODA4NTc0NSwibmJmIjoxNjI4MDg0ODM1LCJpYXQiOjE2MjgwODQ4NDUsImp0aSI6Ijc2ODgyNTg3NDU2NTkwNDcyNzUiLCJhY2Nlc3MiOltdfQ.Qfp31vBooPIQT27Yl55bolbZbsY4RfOOYfkyoCPQqx8F6B2yX8flzq1byIAlkkcy7mKwvqUtF2DriiMd633MXLO_ZRfRE1rjE1BOZgA_lXPJ3Iz-5shMucYQY2Dxuq7gK2lnr-FGoB4YPNTFIxAnjDo2TQ4m4a0xTwhqvx_VC-chxgHzpQpOMyQSgCZ8Uvp0DxQd7Z4FfDx8dqKsU0ToGzA0Q2URzIacVQ8X27wFsNXacupAUDN59LCLHttLW90Ujb_dB5fHUXx3KkJffzw1paqeUmF3bxdFJgBk9cdboerCYSCImuDROkhHUTW3kt0TN_vXkzDu2TDrXayARw2oTg"
}

No refresh_token. Here's the docker output:

auth           | I0804 13:47:25.277643       1 server.go:412] Request: &{Method:POST URL:/auth Proto:HTTP/1.1 ProtoMajor:1 ProtoMinor:1 Header:map[Accept:[*/*] Accept-Encoding:[gzip] Cache-Control:[no-cache] Cdn-Loop:[cloudflare] Cf-Connecting-Ip:[199.36.223.53] Cf-Ipcountry:[CA] Cf-Ray:[67983ccacd124bbf-YUL] Cf-Visitor:[{"scheme":"https"}] Connection:[Keep-Alive] Content-Length:[115] Content-Type:[application/x-www-form-urlencoded] Cookie:[PHPSESSID=s0csatkavj9470t32npdhhfve8] Postman-Token:[314bdd0c-25f2-4bc1-a4bf-7df3fa9a0adb] User-Agent:[PostmanRuntime/7.28.1] X-Forwarded-For:[199.36.223.53] X-Forwarded-Proto:[https]] Body:0xc000588100 GetBody:<nil> ContentLength:115 TransferEncoding:[] Close:false Host:(company):2087 Form:map[] PostForm:map[] MultipartForm:<nil> Trailer:map[] RemoteAddr:(company ip):12194 RequestURI:/auth TLS:0xc000586000 Cancel:<nil> Response:<nil> ctx:0xc000588140}
auth           | I0804 13:47:25.277916       1 server.go:456] Auth request: {myuser:***@(company ip):12194 []}
auth           | I0804 13:47:25.283252       1 server.go:295] Authn static myuser -> true, map[], <nil>
auth           | I0804 13:47:25.294541       1 server.go:407] New token for {myuser:***@(company ip):12194 []} map[]: {"iss":"company-token-issuer","sub":"myuser","aud":"company-token-service","exp":1628085745,"nbf":1628084835,"iat":1628084845,"jti":"7688258745659047275","access":[]}
auth           | I0804 13:47:25.294603       1 server.go:492] {"access_token":"(token above)"}

docker-compose.yml:

version: "3.5"

services:
  registry:
    restart: always
    image: registry:2
    container_name: registry
    ports:
      - 8443:443
    environment:
      REGISTRY_HTTP_ADDR: 0.0.0.0:443
      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/bundle.crt
      REGISTRY_HTTP_TLS_KEY: /certs/company.key
      REGISTRY_AUTH_TOKEN_REALM: https://(company):2087/auth
      REGISTRY_AUTH_TOKEN_SERVICE: company-token-service
      REGISTRY_AUTH_TOKEN_ISSUER: company-token-issuer
      REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE: /certs/bundle.crt
    volumes:
      - /home/myuser/certs:/certs
      - /home/myuser/docker-registry/data:/var/lib/registry

  docker_auth:
    restart: always
    image: cesanta/docker_auth:1
    container_name: auth
    ports:
      - 2087:2087
    volumes:
      - /home/myuser/docker-registry:/config:ro
      - /var/log/docker_auth:/logs
      - /home/myuser/certs:/certs
    command: --v=4 -log_dir /logs -alsologtostderr /config/auth_config.yml

auth_config.yml:

server:
  addr: ":2087"
  certificate: "/certs/bundle.crt"
  key: "/certs/(company).key"
token:
  issuer: "company-token-issuer"  # Must match issuer in the Registry config.
  expiration: 900
users:
  "myuser":
    password: "$2y$05$dHqSnejfhOycqL4FixW.Nu.HDftwQU7iuNyzdDs6/qK7.M9PfvZ9i"
  "": {} # anonymous
acl:
  - match: {account: "myuser"}
    actions: ["*"]
  - match: {account: ""}
    actions: ["pull"]

In addition, with the config above with anonymous access, I seem to receive the same access_token/token regardless of the POST parameters (even without parameters at all). Because of this, if I send a POST with grant_type=refresh_token and refresh_token=(random garbage), I still receive the access_token and no check seems to be done. Example request, response and docker output in that case: curl --location --request POST 'https://(company):2087/auth

{
    "access_token": "(the token)",
    "token": "(the token)"
}

auth           | I0804 14:02:39.065846       1 server.go:412] Request: &{Method:POST URL:/auth Proto:HTTP/1.1 ProtoMajor:1 ProtoMinor:1 Header:map[Accept:[*/*] Accept-Encoding:[gzip] Cache-Control:[no-cache] Cdn-Loop:[cloudflare] Cf-Connecting-Ip:[199.36.223.53] Cf-Ipcountry:[CA] Cf-Ray:[67985319e8014bbf-YUL] Cf-Visitor:[{"scheme":"https"}] Connection:[Keep-Alive] Content-Length:[0] Cookie:[PHPSESSID=s0csatkavj9470t32npdhhfve8] Postman-Token:[e9fa290c-8757-4eef-bcc9-5a9fb39a2d0b] User-Agent:[PostmanRuntime/7.28.1] X-Forwarded-For:[199.36.223.53] X-Forwarded-Proto:[https]] Body:{} GetBody:<nil> ContentLength:0 TransferEncoding:[] Close:false Host:(company):2087 Form:map[] PostForm:map[] MultipartForm:<nil> Trailer:map[] RemoteAddr:(company ip):14286 RequestURI:/auth TLS:0xc0003ea0b0 Cancel:<nil> Response:<nil> ctx:0xc0005881c0}
auth           | I0804 14:02:39.066004       1 server.go:456] Auth request: {:@(company ip):14286 []}
auth           | I0804 14:02:39.066029       1 server.go:295] Authn static  -> true, map[], <nil>
auth           | I0804 14:02:39.077271       1 server.go:407] New token for {:@(company ip):14286 []} map[]: {"iss":"company-token-issuer","sub":"","aud":"","exp":1628086659,"nbf":1628085749,"iat":1628085759,"jti":"1006871144220648292","access":[]}
auth           | I0804 14:02:39.077324       1 server.go:492] {"access_token":"(some token)"}

Am I doing something wrong? Thanks

cesanta / docker_auth

Trouble getting refresh_token using OAuth2 #313