Working group proposal for auth by sudo-bmitch · Pull Request #119 · opencontainers/tob

sudo-bmitch · 2022-11-11T01:56:51Z

Signed-off-by: Brandon Mitchell git@bmitch.net

This PR proposes a new working group to specify authentication and authorization between registries and clients.

References:

Existing docker specification on bearer auth: https://distribution.github.io/distribution/spec/auth/
Distribution spec issue: Feature: Authentication and authorization support distribution-spec#240
Distribution spec issue: AutH/AuthZ flows for registries distribution-spec#338
OCI meeting at CloudNativeCon where the need for a working group was discussed: https://hackmd.io/nZzK_4AfRz-xgya6KkqseA

Signed-off-by: Brandon Mitchell <git@bmitch.net>

toddysm · 2022-11-15T22:45:32Z

@sudo-bmitch I guess this WG will address opencontainers/distribution-spec#338 - correct?

sudo-bmitch · 2022-11-15T23:40:49Z

@sudo-bmitch I guess this WG will address opencontainers/distribution-spec#338 - correct?

Yes, that should be addressed by the WG.

dmcgowan · 2022-11-17T19:02:50Z

+
+## Scope
+
+* Define registry responses to unauthenticated requests.


Is this referring to the "anonymous" pull case where an authentication server is giving out tokens for unauthenticated requests?

I'm thinking of requests where either there is no Authorization header, or the token in the header does not apply to the request (a pull token used to push, or a token for a different repository being reused for a future request).

dmcgowan · 2022-11-17T19:06:20Z

I agree with having the working group for drafting the spec. It was unclear from the scope where there is any "new" functionality or use cases which this group is also aiming to support/investigate. I would consider "new" to be cases not currently support by a majority of clients/registries.

sudo-bmitch · 2022-11-18T01:40:11Z

I agree with having the working group for drafting the spec. It was unclear from the scope where there is any "new" functionality or use cases which this group is also aiming to support/investigate. I would consider "new" to be cases not currently support by a majority of clients/registries.

There are probably some edge cases, but a majority of the effort will be standardizing something that should work with existing servers and clients. Do we need new functionality to be a working group?

Signed-off-by: Brandon Mitchell <git@bmitch.net>

dmcgowan · 2022-11-18T04:50:38Z

@sudo-bmitch no, just to avoid scope creep and a never ending working group. Most the efforts to standardize existing behavior allowed limited new functionality, except for known limitations/pain points.

Signed-off-by: Brandon Mitchell <git@bmitch.net>

sagikazarmark · 2022-12-23T16:35:11Z

I'm glad to see this is happening.

I have a working implementation of the Docker registry authorization server spec here: https://github.com/distribution-auth/auth

I've spent some time with registry authnz lately, so I'd be happy to help however I can (work on spec, tinker with implementation, etc)

sudo-bmitch · 2022-12-23T17:37:33Z

Volunteers for stakeholders and proposed owners are welcome/needed.

vsoch · 2023-01-17T13:16:44Z

There has been some discussion in the ORAS community about use of the Docker credential file in this flow (about how many tools do it but it’s not a standard) so I’d like to suggest this is considered to be in scope here. It would be ideal to have the full flow from defining the credential through authorization standardized for common tooling and less adhoc standards in the space as we have now.

toddysm · 2023-01-30T16:32:09Z

+* Specify how clients negotiate access to multiple repositories for actions like a cross-repository blob mount.
+* Specify how clients and registries should renegotiate access for a request with expired or insufficient authorization.
+* Specify expected lifetime of registry credentials.
+* Avoid specifications that would prevent future extensibility (e.g. fine grain access control).


Does that mean no discussions about ABAC?

I'd say we discuss it enough to know that we aren't excluding the possibility from future specs.

toddysm · 2023-01-30T16:37:27Z

@sudo-bmitch what are the next steps for this WG? I will be interested to participate because we are regularly hitting issues with auth with various registries.

sudo-bmitch · 2023-01-30T18:12:43Z

@toddysm proposed owners/stakeholders are needed. Feel free to nominate yourself and/or projects you represent.

toddysm · 2023-01-30T19:19:38Z

+
+The following have agreed to participate in the working group, review progress, report progress back to the OCI community, and present the results to the TOB once the working group has completed its objectives.
+
+* Brandon Mitchell (@sudo-bmitch)


Would you mind adding me:
Toddy Mladenov (@toddysm)

@rchincha Would you like to be part of the WG? I saw that you added zot below.

Yes, pls add me if no concerns/objections.

toddysm · 2023-01-30T19:25:20Z

+
+OCI Projects, non-OCI projects, or organizations sponsoring the working group and participating in the implementation and use case validation of the work done by the group.
+
+* [regclient][regclient]


I can represent the following projects and tools:

oras
notation
ACR CLI

jcarter3 · 2023-01-31T18:58:48Z

I'm happy to represent Docker Hub

imjasonh · 2023-05-04T21:35:59Z

I'm willing to represent Chainguard.

What more do we need to get this moving?

samuelkarp · 2023-05-04T23:36:13Z

+
+## Stakeholders
+
+OCI Projects, non-OCI projects, or organizations sponsoring the working group and participating in the implementation and use case validation of the work done by the group.


Since the target of this WG is the distribution-spec, are there any other maintainers of the spec who can act as stakeholders?

wave.. I can rep for distribution

Signed-off-by: Brandon Mitchell <git@bmitch.net>

sajayantony · 2023-06-29T17:39:19Z

Looks like we have enough stake holders. Request the @opencontainers/tob to consider kicking this off.

samuelkarp · 2023-07-07T05:37:25Z

I'll call the vote for @opencontainers/tob. Please approve, request changes, reply with LGTM, or not (and hopefully say why!).

A 2/3 approval is required here, so 6/9 of the TOB members must approve.

sudo-bmitch · 2023-07-07T11:08:11Z

LGTM

dmcgowan · 2023-07-07T12:41:09Z

LGTM

vbatts

LGTM

estesp

LGTM

jdolitsky · 2023-07-07T15:13:00Z

got 6 out of 9 votes, merging

Working group proposal for auth

4587043

Signed-off-by: Brandon Mitchell <git@bmitch.net>

dmcgowan reviewed Nov 17, 2022

View reviewed changes

mikebrow reviewed Nov 17, 2022

View reviewed changes

Comment thread proposals/wg-auth.md Outdated

sudo-bmitch added 2 commits November 17, 2022 20:51

Adding owner and stakeholder sections

6c48576

Signed-off-by: Brandon Mitchell <git@bmitch.net>

Include auth in list of current working groups

5f91136

Signed-off-by: Brandon Mitchell <git@bmitch.net>

Avoid new functionality

85e17a1

Signed-off-by: Brandon Mitchell <git@bmitch.net>

mikebrow reviewed Nov 28, 2022

View reviewed changes

Comment thread proposals/wg-auth.md

Adding PR feedback

381de56

Signed-off-by: Brandon Mitchell <git@bmitch.net>

toddysm reviewed Jan 30, 2023

View reviewed changes

toddysm suggested changes Jan 30, 2023

View reviewed changes

tianon mentioned this pull request Apr 6, 2023

Add 307 as valid response for pulling blobs opencontainers/distribution-spec#398

Closed

samuelkarp reviewed May 4, 2023

View reviewed changes

sudo-bmitch force-pushed the pr-wg-auth branch from 4b5f463 to 3ee2d81 Compare May 7, 2023 20:00

Adding owners and stakeholders

f6b5bd8

Signed-off-by: Brandon Mitchell <git@bmitch.net>

sudo-bmitch force-pushed the pr-wg-auth branch from 3ee2d81 to f6b5bd8 Compare May 25, 2023 23:22

dmcgowan mentioned this pull request Jun 5, 2023

add harbor rc for issuing a token in the comments containerd/containerd#8630

Closed

samuelkarp approved these changes Jul 7, 2023

View reviewed changes

vbatts approved these changes Jul 7, 2023

View reviewed changes

estesp approved these changes Jul 7, 2023

View reviewed changes

jdolitsky approved these changes Jul 7, 2023

View reviewed changes

jdolitsky merged commit ea1e330 into opencontainers:main Jul 7, 2023

sudo-bmitch deleted the pr-wg-auth branch July 7, 2023 15:30

milosgajdos mentioned this pull request Jul 19, 2023

AccessController interface should return either Challenge or PermissionDenied errors distribution/distribution#967

Open

seniorquico mentioned this pull request Oct 7, 2023

DO NOT MERGE: fix: allow empty scope on /v2 project-zot/zot#1814

Closed


		## Scope

		* Define registry responses to unauthenticated requests.


		The following have agreed to participate in the working group, review progress, report progress back to the OCI community, and present the results to the TOB once the working group has completed its objectives.

		* Brandon Mitchell (@sudo-bmitch)


		OCI Projects, non-OCI projects, or organizations sponsoring the working group and participating in the implementation and use case validation of the work done by the group.

		* [regclient][regclient]


		## Stakeholders

		OCI Projects, non-OCI projects, or organizations sponsoring the working group and participating in the implementation and use case validation of the work done by the group.

Conversation

sudo-bmitch commented Nov 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

toddysm commented Nov 15, 2022

Uh oh!

sudo-bmitch commented Nov 15, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dmcgowan commented Nov 17, 2022

Uh oh!

Uh oh!

sudo-bmitch commented Nov 18, 2022

Uh oh!

dmcgowan commented Nov 18, 2022

Uh oh!

Uh oh!

sagikazarmark commented Dec 23, 2022

Uh oh!

sudo-bmitch commented Dec 23, 2022

Uh oh!

vsoch commented Jan 17, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

toddysm commented Jan 30, 2023

Uh oh!

sudo-bmitch commented Jan 30, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jcarter3 commented Jan 31, 2023

Uh oh!

imjasonh commented May 4, 2023

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sajayantony commented Jun 29, 2023

Uh oh!

samuelkarp commented Jul 7, 2023 • edited by jdolitsky Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sudo-bmitch commented Jul 7, 2023

Uh oh!

dmcgowan commented Jul 7, 2023

Uh oh!

vbatts left a comment

Choose a reason for hiding this comment

Uh oh!

estesp left a comment

Choose a reason for hiding this comment

Uh oh!

jdolitsky commented Jul 7, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

sudo-bmitch commented Nov 11, 2022 •

edited

Loading

samuelkarp commented Jul 7, 2023 •

edited by jdolitsky

Loading