2014-03-11 04:16:58 +04:00
package registry
2013-03-15 04:43:59 +04:00
import (
"encoding/json"
"fmt"
"io/ioutil"
"net/http"
"strings"
2014-06-03 04:46:06 +04:00
2015-03-27 01:22:04 +03:00
"github.com/Sirupsen/logrus"
2015-04-22 15:06:58 +03:00
"github.com/docker/docker/cliconfig"
2013-03-15 04:43:59 +04:00
)
2014-12-12 04:55:15 +03:00
// Login tries to register/login to the registry server.
2015-05-14 17:12:54 +03:00
func Login ( authConfig * cliconfig . AuthConfig , registryEndpoint * Endpoint ) ( string , error ) {
2014-12-12 04:55:15 +03:00
// Separates the v2 registry login logic from the v1 logic.
if registryEndpoint . Version == APIVersion2 {
2015-05-29 06:46:20 +03:00
return loginV2 ( authConfig , registryEndpoint , "" /* scope */ )
2014-12-12 04:55:15 +03:00
}
2015-05-14 17:12:54 +03:00
return loginV1 ( authConfig , registryEndpoint )
2014-12-12 04:55:15 +03:00
}
// loginV1 tries to register/login to the v1 registry server.
2015-05-14 17:12:54 +03:00
func loginV1 ( authConfig * cliconfig . AuthConfig , registryEndpoint * Endpoint ) ( string , error ) {
2014-02-06 04:49:43 +04:00
var (
2015-01-12 22:56:01 +03:00
status string
reqBody [ ] byte
err error
2014-02-06 04:49:43 +04:00
reqStatusCode = 0
serverAddress = authConfig . ServerAddress
)
2013-09-03 22:45:49 +04:00
2015-03-27 01:22:04 +03:00
logrus . Debugf ( "attempting v1 login to registry endpoint %s" , registryEndpoint )
2014-12-12 04:55:15 +03:00
2013-09-03 22:45:49 +04:00
if serverAddress == "" {
2014-10-07 05:54:52 +04:00
return "" , fmt . Errorf ( "Server Error: Server Address not set." )
2013-09-03 22:45:49 +04:00
}
2015-07-21 22:40:36 +03:00
loginAgainstOfficialIndex := serverAddress == IndexServer
2013-09-03 22:45:49 +04:00
2013-12-25 04:37:00 +04:00
// to avoid sending the server address to the server it should be removed before being marshalled
2013-09-03 22:45:49 +04:00
authCopy := * authConfig
authCopy . ServerAddress = ""
jsonBody , err := json . Marshal ( authCopy )
2013-03-16 01:41:55 +04:00
if err != nil {
2013-04-24 20:11:29 +04:00
return "" , fmt . Errorf ( "Config Error: %s" , err )
2013-03-16 01:41:55 +04:00
}
2013-04-02 14:00:21 +04:00
// using `bytes.NewReader(jsonBody)` here causes the server to respond with a 411 status.
b := strings . NewReader ( string ( jsonBody ) )
2015-05-16 04:35:04 +03:00
req1 , err := registryEndpoint . client . Post ( serverAddress + "users/" , "application/json; charset=utf-8" , b )
2013-03-15 05:43:02 +04:00
if err != nil {
2013-04-24 20:11:29 +04:00
return "" , fmt . Errorf ( "Server Error: %s" , err )
2013-03-15 04:43:59 +04:00
}
2013-03-16 01:41:55 +04:00
defer req1 . Body . Close ( )
2015-11-25 17:33:15 +03:00
reqStatusCode = req1 . StatusCode
2013-03-16 01:41:55 +04:00
reqBody , err = ioutil . ReadAll ( req1 . Body )
if err != nil {
2013-04-24 20:11:29 +04:00
return "" , fmt . Errorf ( "Server Error: [%#v] %s" , reqStatusCode , err )
2013-03-16 01:41:55 +04:00
}
2013-03-15 05:43:02 +04:00
2013-03-15 04:43:59 +04:00
if reqStatusCode == 201 {
2013-09-03 22:45:49 +04:00
if loginAgainstOfficialIndex {
status = "Account created. Please use the confirmation link we sent" +
" to your e-mail to activate it."
} else {
2014-10-07 05:54:52 +04:00
// *TODO: Use registry configuration to determine what this says, if anything?
2013-09-03 22:45:49 +04:00
status = "Account created. Please see the documentation of the registry " + serverAddress + " for instructions how to activate it."
}
2013-03-15 04:43:59 +04:00
} else if reqStatusCode == 400 {
2013-05-01 20:06:17 +04:00
if string ( reqBody ) == "\"Username or email already exists\"" {
2015-05-14 17:12:54 +03:00
req , err := http . NewRequest ( "GET" , serverAddress + "users/" , nil )
2013-03-15 04:43:59 +04:00
req . SetBasicAuth ( authConfig . Username , authConfig . Password )
2015-05-16 04:35:04 +03:00
resp , err := registryEndpoint . client . Do ( req )
2013-03-15 04:43:59 +04:00
if err != nil {
return "" , err
}
defer resp . Body . Close ( )
body , err := ioutil . ReadAll ( resp . Body )
if err != nil {
return "" , err
}
if resp . StatusCode == 200 {
2014-10-29 03:42:03 +03:00
return "Login Succeeded" , nil
2013-05-02 03:36:01 +04:00
} else if resp . StatusCode == 401 {
return "" , fmt . Errorf ( "Wrong login/password, please try again" )
2013-12-06 03:10:44 +04:00
} else if resp . StatusCode == 403 {
if loginAgainstOfficialIndex {
return "" , fmt . Errorf ( "Login: Account is not Active. Please check your e-mail for a confirmation link." )
}
2014-10-07 05:54:52 +04:00
// *TODO: Use registry configuration to determine what this says, if anything?
2013-12-06 03:10:44 +04:00
return "" , fmt . Errorf ( "Login: Account is not Active. Please see the documentation of the registry %s for instructions how to activate it." , serverAddress )
2015-07-01 23:02:55 +03:00
} else if resp . StatusCode == 500 { // Issue #14326
logrus . Errorf ( "%s returned status code %d. Response Body :\n%s" , req . URL . String ( ) , resp . StatusCode , body )
return "" , fmt . Errorf ( "Internal Server Error" )
2013-03-15 04:43:59 +04:00
}
2014-10-06 23:34:39 +04:00
return "" , fmt . Errorf ( "Login: %s (Code: %d; Headers: %s)" , body , resp . StatusCode , resp . Header )
2013-03-15 04:43:59 +04:00
}
2014-10-06 23:34:39 +04:00
return "" , fmt . Errorf ( "Registration: %s" , reqBody )
2013-11-07 22:36:02 +04:00
} else if reqStatusCode == 401 {
// This case would happen with private registries where /v1/users is
// protected, so people can use `docker login` as an auth check.
2015-05-14 17:12:54 +03:00
req , err := http . NewRequest ( "GET" , serverAddress + "users/" , nil )
2013-11-07 22:36:02 +04:00
req . SetBasicAuth ( authConfig . Username , authConfig . Password )
2015-05-16 04:35:04 +03:00
resp , err := registryEndpoint . client . Do ( req )
2013-11-07 22:36:02 +04:00
if err != nil {
return "" , err
}
defer resp . Body . Close ( )
body , err := ioutil . ReadAll ( resp . Body )
if err != nil {
return "" , err
2013-12-06 03:10:44 +04:00
}
2013-11-07 22:36:02 +04:00
if resp . StatusCode == 200 {
2014-10-29 03:42:03 +03:00
return "Login Succeeded" , nil
2013-11-07 22:36:02 +04:00
} else if resp . StatusCode == 401 {
return "" , fmt . Errorf ( "Wrong login/password, please try again" )
} else {
return "" , fmt . Errorf ( "Login: %s (Code: %d; Headers: %s)" , body ,
resp . StatusCode , resp . Header )
}
2013-03-15 05:43:02 +04:00
} else {
2013-04-24 20:11:29 +04:00
return "" , fmt . Errorf ( "Unexpected status code [%d] : %s" , reqStatusCode , reqBody )
2013-03-15 04:43:59 +04:00
}
return status , nil
}
2013-09-03 22:45:49 +04:00
2014-12-12 04:55:15 +03:00
// loginV2 tries to login to the v2 registry server. The given registry endpoint has been
// pinged or setup with a list of authorization challenges. Each of these challenges are
// tried until one of them succeeds. Currently supported challenge schemes are:
// HTTP Basic Authorization
// Token Authorization with a separate token issuing server
// NOTE: the v2 logic does not attempt to create a user account if one doesn't exist. For
// now, users should create their account through other means like directly from a web page
// served by the v2 registry service provider. Whether this will be supported in the future
// is to be determined.
2015-05-29 06:46:20 +03:00
func loginV2 ( authConfig * cliconfig . AuthConfig , registryEndpoint * Endpoint , scope string ) ( string , error ) {
2015-03-27 01:22:04 +03:00
logrus . Debugf ( "attempting v2 login to registry endpoint %s" , registryEndpoint )
2014-12-12 04:55:15 +03:00
var (
err error
allErrors [ ] error
)
for _ , challenge := range registryEndpoint . AuthChallenges {
2015-05-29 06:46:20 +03:00
params := make ( map [ string ] string , len ( challenge . Parameters ) + 1 )
for k , v := range challenge . Parameters {
params [ k ] = v
}
params [ "scope" ] = scope
logrus . Debugf ( "trying %q auth challenge with params %v" , challenge . Scheme , params )
2014-12-12 04:55:15 +03:00
switch strings . ToLower ( challenge . Scheme ) {
case "basic" :
2015-05-29 06:46:20 +03:00
err = tryV2BasicAuthLogin ( authConfig , params , registryEndpoint )
2014-12-12 04:55:15 +03:00
case "bearer" :
2015-05-29 06:46:20 +03:00
err = tryV2TokenAuthLogin ( authConfig , params , registryEndpoint )
2014-12-12 04:55:15 +03:00
default :
// Unsupported challenge types are explicitly skipped.
err = fmt . Errorf ( "unsupported auth scheme: %q" , challenge . Scheme )
}
if err == nil {
return "Login Succeeded" , nil
}
2015-03-27 01:22:04 +03:00
logrus . Debugf ( "error trying auth challenge %q: %s" , challenge . Scheme , err )
2014-12-12 04:55:15 +03:00
allErrors = append ( allErrors , err )
}
return "" , fmt . Errorf ( "no successful auth challenge for %s - errors: %s" , registryEndpoint , allErrors )
}
2015-05-16 04:35:04 +03:00
func tryV2BasicAuthLogin ( authConfig * cliconfig . AuthConfig , params map [ string ] string , registryEndpoint * Endpoint ) error {
2015-05-14 17:12:54 +03:00
req , err := http . NewRequest ( "GET" , registryEndpoint . Path ( "" ) , nil )
2014-12-12 04:55:15 +03:00
if err != nil {
return err
}
req . SetBasicAuth ( authConfig . Username , authConfig . Password )
2015-05-16 04:35:04 +03:00
resp , err := registryEndpoint . client . Do ( req )
2014-12-12 04:55:15 +03:00
if err != nil {
return err
}
defer resp . Body . Close ( )
if resp . StatusCode != http . StatusOK {
return fmt . Errorf ( "basic auth attempt to %s realm %q failed with status: %d %s" , registryEndpoint , params [ "realm" ] , resp . StatusCode , http . StatusText ( resp . StatusCode ) )
}
return nil
}
2015-05-16 04:35:04 +03:00
func tryV2TokenAuthLogin ( authConfig * cliconfig . AuthConfig , params map [ string ] string , registryEndpoint * Endpoint ) error {
token , err := getToken ( authConfig . Username , authConfig . Password , params , registryEndpoint )
2014-12-12 04:55:15 +03:00
if err != nil {
return err
}
2015-05-14 17:12:54 +03:00
req , err := http . NewRequest ( "GET" , registryEndpoint . Path ( "" ) , nil )
2014-12-12 04:55:15 +03:00
if err != nil {
return err
}
req . Header . Set ( "Authorization" , fmt . Sprintf ( "Bearer %s" , token ) )
2015-05-16 04:35:04 +03:00
resp , err := registryEndpoint . client . Do ( req )
2014-12-12 04:55:15 +03:00
if err != nil {
return err
}
defer resp . Body . Close ( )
if resp . StatusCode != http . StatusOK {
return fmt . Errorf ( "token auth attempt to %s realm %q failed with status: %d %s" , registryEndpoint , params [ "realm" ] , resp . StatusCode , http . StatusText ( resp . StatusCode ) )
}
return nil
}
2015-07-21 22:40:36 +03:00
// ResolveAuthConfig matches an auth configuration to a server address or a URL
2015-04-22 15:06:58 +03:00
func ResolveAuthConfig ( config * cliconfig . ConfigFile , index * IndexInfo ) cliconfig . AuthConfig {
2014-10-07 05:54:52 +04:00
configKey := index . GetAuthConfigKey ( )
2014-02-21 02:57:58 +04:00
// First try the happy case
2015-04-02 01:39:37 +03:00
if c , found := config . AuthConfigs [ configKey ] ; found || index . Official {
2014-02-21 02:57:58 +04:00
return c
2013-09-03 22:45:49 +04:00
}
2014-02-21 02:57:58 +04:00
convertToHostname := func ( url string ) string {
stripped := url
if strings . HasPrefix ( url , "http://" ) {
stripped = strings . Replace ( url , "http://" , "" , 1 )
} else if strings . HasPrefix ( url , "https://" ) {
stripped = strings . Replace ( url , "https://" , "" , 1 )
2013-09-03 22:45:49 +04:00
}
2014-02-21 02:57:58 +04:00
nameParts := strings . SplitN ( stripped , "/" , 2 )
return nameParts [ 0 ]
2013-09-03 22:45:49 +04:00
}
2014-02-21 02:57:58 +04:00
// Maybe they have a legacy config file, we will iterate the keys converting
// them to the new format and testing
2015-04-22 15:06:58 +03:00
for registry , ac := range config . AuthConfigs {
2014-10-07 05:54:52 +04:00
if configKey == convertToHostname ( registry ) {
2015-04-22 15:06:58 +03:00
return ac
2014-02-21 02:57:58 +04:00
}
2013-09-03 22:45:49 +04:00
}
2014-02-21 02:57:58 +04:00
// When all else fails, return an empty auth config
2015-04-22 15:06:58 +03:00
return cliconfig . AuthConfig { }
2015-04-02 01:39:37 +03:00
}