goauthentik / goauthentik/authentik

Support GET requests on /application/o/token

Open
#11,714 4 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

**Is your feature request related to a problem? Please describe.**
I want to use authentik as oauth2 for docker registry (distribution/distribution on GitHub). Unfortunately it uses GET requests for `/application/o/token` endpoint instead of POST (see https://github.com/distribution/distribution/blob/main/docs/content/spec/auth/token.md for details, TLDR: `To respond to this challenge, the client will need to make a GET request to the URL`).

**Describe the solution you'd like**
It would be great if authentik could support both POST and GET requests on this endpoint.

**Additional context**
I'm not sure why they decided to use GET and if there is any RFC which covers which version should be used, but I assume that adding support for both in authentik wouldn't be problematic.

This is the request docker client does to authentik, in order to obtain token: `"GET /application/o/token?account=USERNAME&client_id=docker&offline_token=true&service=SERVICE_VALUE_FROM_REGISTRY_CONFIG HTTP/1.1" 400 140 "-" "docker/24.0.7 go/go1.20.10 git-commit/311b9ff kernel/5.15.153.1-microsoft-standard-WSL2 os/linux arch/amd64 UpstreamClient(Docker-Client/24.0.7 \x5C(linux\x5C))"`. Client ID seems to be hardcoded, but it can be set to any value in authentik so that should work. `SERVICE_VALUE_FROM_REGISTRY_CONFIG ` is value from `config.yml` registry file, section `auth.token.service`.

Contributor guide

Open the contributing guide

Research direction

Start at the /application/o/token endpoint and read the linked Docker Distribution token-auth specification to compare its GET request and query parameters with authentik's current behavior. Done means Docker registry token requests using GET are accepted while existing POST requests continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, authentication
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.