I'm setting up a docker registry using the container provided in the official documentation.
I setup the token authentication for the registry and I would like to consume the catalog API, e.g. for
listing repositories, but I would like to restrict it at the user level.
Therefore, an authenticated user, at the point of calling myregistry.com/v2/_catalog it will get as part
of the response body just the repositories where he has access.
Is there any middleware mechanism that can be easily implemented within the current docker registry
version?
If not, what is the recommended approach you would suggest in order to fulfil this use case.
Related
I'm looking to test automated container builds on Dockerhub, and I see that I need to link my github account to my hub.docker.account.
However, when I click on the 'connect' button, I'm taken to a github authorization page that says:
Docker Hub Builder by docker wants to access your larryms account
Repositories
Public and private
This application will be able to read and write all public and private repository data.
This includes the following:
- Code
- Issues
- Pull requests
- Wikis
- Settings
- Webhooks and services
- Deploy keys
- Collaboration invites
This seems far too permissive and overly broad; if I'm understanding it correctly, I need to grant Docker Hub Builder read & write access to all my github repositories, both public and private.
Is there any way to do this using the principle of least privilege, eg only granting Docker Hub Builder necessary rights (hopefully read only) only to specific github repos?
OAuth scopes on GitHub are indeed wide (see https://developer.github.com/apps/building-oauth-apps/understanding-scopes-for-oauth-apps/#available-scopes, where you cannot grant read access without granting write access as well). However, the scopes are applied together with the actual permissions the user has on the repo in question. That is, if the user has only read access to repo X, and the user granted an oauth token with read & write scope to dockerhub, dockerhub would only be able to read from repo X on behalf of this user. If the user gets admin access to repo X later on, the already granted access token will not allow admin access, as the scope of the token allows read & write access only.
With this in mind, you can create a dedicated user for dockerhub in your github org, and grant this user read access to relevant repos. Then connect dockerhub to your github account with this user, granting just read access to the selected repos.
Spring Cloud Data Flow Server (Local) does not have any dynamic way to set up users and roles either through dashboard UI or shell, ie. there is no way to add or delete users with roles while the server is running.
I have been able to get both single user or file based authentication and authorization working but both of them I had to set up the docker-compose.yml file like so:
spring.cloud.dataflow.security.authentication.file.enabled=true
spring.cloud.dataflow.security.authentication.file.users.bob=bobpass, ROLE_MANAGE
spring.cloud.dataflow.security.authentication.file.users.alice=alicepass, ROLE_VIEW, ROLE_CREATE
spring.cloud.dataflow.security.authentication.file.users.hare=harepass, ROLE_VIEW
However, if I have to add new users with roles, I will have to docker-compose down, edit the docker-compose.yml and then do docker-compose up, for the new user authentication authorization to work.
Is there any work around this?
There isn't any other approach to dynamically add/update users and then have it reflect at runtime in SCDF.
However, in SCDF 2.0, we have redesigned/rewritten the security architecture. In this baseline, we rely on Cloud Foundry's UAA component, which is a standalone application that can work in Local, CF or K8s.
Here, you can directly interact with UAA outside of SCDF. You can add, update, and delete users, too. Of course, you can centrally manage the OAuth token-credentials such as remote renewals and revocations. Check out the end-to-end sample demonstration of the new design with SCDF + OAuth + LDAP, all in action.
The recent 2.0 M1 release already include this improvement - see blog. Try it out and let us know if you have any questions/feedback.
UPDATE:
I recently also bumped into a UAA Web-UI from the community. Perhaps UAA team could consider adding it to the official stack eventually.
I have a private Docker registry running.
Any user should be able to push and pull any image. Therefore, right now I am not using any user identification at all.
However, a user should not be able to trick the registry to overwrite the Images of other users.
If user A uploads ourRegistry/myProgram:version_1, then user B should not be able to upload something tagged ourRegistry/myProgram:version_2.
Is there a way to add user authentification to a private registry to do this?
Additionally, the registry is part of a server that already has its own database of registered users. Is there a way to synchronize the users, so that the users don't have to remember two passwords?
The official documentation on docker registry authentication is located here: https://docs.docker.com/registry/deploying/#native-basic-auth. Since it uses htpasswd to handle its authentication I'm not sure if there's any way to use your user database dynamically (obviously you can write a script to import all your users using htpasswd mentioned in this documentation)
I am trying to create separate push and pull for docker registry in terms of safety reasons. Is it possible to create it in any of the container registries.
Docker Registry 2.0 introduced a new, token-based authentication and authorization protocol. ACL is supported if you use token based authentication for the docker registry. You can use a pre-built ACL solution like this https://github.com/cesanta/docker_auth.
It porvides fine grained ACL rules, e.g.
acl:
- match: {account: "admin"}
actions: ["*"]
comment: "Admin has full access to everything."
- match: {account: "user"}
actions: ["pull"]
comment: "User \"user\" can pull stuff."
# Access is denied by default.
see full example https://github.com/cesanta/docker_auth/blob/master/examples/simple.yml
For your scenario you can create two users with push and pull permissions only, then login as appropriate user for the operation (push or pull).
If you use Docker Hub, there is already sort of ACL for organisations.
Docker Hub organizations let you create teams so you can give
colleagues access to shared image repositories. A Docker Hub
organization can contain public and private repositories just like a
user account. Access to push or pull for these repositories is
allocated by defining teams of users and then assigning team rights to
specific repositories. Repository creation is limited to users in the
organization owner’s group. This allows you to distribute limited
access Docker images, and to select which Docker Hub users can publish
new images.
https://docs.docker.com/docker-hub/orgs/#repository-team-permissions
Permissions are cumulative. For example, if you have Write
permissions, you automatically have Read permissions:
Read access allows users to view, search, and pull a private repository in the same way as they can a public repository.
Write access allows users to push to non-automated repositories on the Docker Hub.
Admin access allows users to modify the repositories “Description”, “Collaborators” rights, “Public/Private” visibility
and “Delete”.
In your scenario you must have at least two registered hub users, then one of them could be a member of a team with Read only permissions, the other user could be a member of a team with Write (and automatically Read) access.
Note: A User who has not yet verified their email address only has
Read access to the repository, regardless of the rights their team
membership has given them.
I have currently set up a web-based application, to which I have added an authentication method using oauth2_proxy (with gitlab as authentication provider). What I need to know is if there's way that I can restrict the access to this app using a Gitlab group or something like that? Because as of now - oauth is configured to allow access to any user on gitlab which has a #foor.bar email domain (-email-domain=foo.bar directive on oauth config). However I'm looking to control this method in a more restricted manner, so for instance I will create a group on Gitlab, to which I will add only relevant users & other groups to which access should be granted. Is there a way to do it?
Not sure if it's what you're looking for but regards documentation you could use --authenticated-emails-file param to provide authenticated emails list.