acorn login succeeds even when invalid credentials are used to login to private registry.

[sangee2004]

acorn version v0.7.0-alpha1-49-gf5e99d78+f5e99d78

Steps to reproduce the problem:
Stand up a private registry with auth enabled.
acorn login succeeds when invalid credentials are passed to it.

 acorn login <registry url>
? Username ss
? Password **
  ✔  Login to <registry url> as ss succeeded

 % acorn login <registry url>
? Username f4zk2pnd
? Password ****
  ✔  Login to<registry url>as f4zk2pnd succeeded

 % docker login <registry url>
Username: ss
Password: 
login attempt to <registry url>/v2/ failed with status: 401 Unauthorized

[cjellick]

Is this the case for docker.io and ghcr.io or just registries you standup yourself?

[sangee2004]

This is only in the case of registries that i create ( I used - https://github.com/acorn-io/library/tree/main/registry). docker.io and ghcr.io work as expected.

[g-linville]

So the reason that ghcr.io, docker.io, etc. don't have this problem is because they are using a different type of authentication than what our image registry library Acorn uses.

We are relying on this call to transport.NewWithContext to determine whether the login credentials are valid:

runtime/pkg/server/registry/apigroups/acorn/credentials/strategy.go

Line 53 in ff32506

_, err = transport.NewWithContext(ctx, reg, auth, http.DefaultTransport, nil)

This function behaves differently depending on whether basic or bearer authentication is used. If bearer (like docker.io and ghcr.io), then the credentials do get validated. If basic, they do not. That is the reason for this disparity.

Unfortunately, I do not think there is a clean way to validate credentials in the case of basic authentication. The container registry API does not have an endpoint to simply check whether a user is logged in. We could possibly try to get some strange image that likely doesn't exist (i.e. <registry host>/acorn:<randomly generated tag>) and check to make sure the error is MANIFEST_UNKNOWN (image not found). But that wouldn't really solve the problem either, since the credential might be able to pull public but not private images.

So basically, I'm not sure what can be done here. Open to ideas/suggestions.

[cjellick]

Low priority. moving out