Need to authenticate for docker registry

[mtrmac]

The “The Registry" chapter seems to assume a registry with no authentication.

With registry.access.redhat.com/openshift3/ose-docker-registry , already the first curl sanity check fails with

< HTTP/1.1 401 Unauthorized
< Content-Type: application/json; charset=utf-8
< Docker-Distribution-Api-Version: registry/2.0
< Www-Authenticate: Basic realm=openshift,error="authorization header with basic token required"
< Date: Mon, 10 Aug 2015 16:35:17 GMT
< Content-Length: 114
<
{"errors":[{"code":"UNAUTHORIZED","message":"access to the requested resource is not authorized","detail":null}]}

which makes sense, because registry.access.redhat.com/openshift3/ose-docker-registry image 1bfb53ecd402 contains

auth:
  openshift:
    realm: openshift

in /config.yml.

With this registry, a simple “docker push $REGISTRY/openshift/ruby-hello-world” as root does not work. Root / system:admin perhaps has the permissions, but docker authentication needs an openshift OAuth token, and I don’t know how system:admin can get one. (Just adding system:admin to htpasswd won’t work because : is a field separator in htpasswd.)

I had to

1. oadm policy add-role-to-user admin alice -n openshift
   (perhaps “edit” would suffice?)
2. (su - alice), then (oc whoami -t)
3. As root, (docker login $REGISTRY) as alice, with the token above as password, and random e-mail
4. Then the push worked.

[xlr-8]

Not sure to understand you correctly, but according to the 'info' here:
https://docs.openshift.com/enterprise/3.0/install_config/install/docker_registry.html#access

You can't use system:admin directly, as it cannot access token. So you have to do the procedure that you did here.

[mtrmac]

Fair enough, but the tutorial does not include that procedure; when following the steps as written, they don’t work.

[dougbtv]

Just want to add a +1 here to include this somewhere in the docs -- I had been trialling atomic registry without auth, and when I was sufficiently sure I was going to stick with it... I added auth, and then.... Didn't have access to push to my registry, so I had to follow the same procedure to give someone admin access e.g.

oadm policy add-role-to-user admin dougbtv -n ProjectName