pulp / pulp/pulp_container

Add a fully working example configuration for token authentication for pulp pod

Open
#1,784 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Docs Task
Dominant language
Python
Stars
31
Forks
56
Avg merge
2d 22h
Merged PRs (30d)
22

Description

The instructions at https://pulpproject.org/pulp_container/docs/admin/learn/authentication/ are not fully clear with regards that you can set up a fully working token authentication with the default pulp pod.

Suggest to improve the documentation (https://pulpproject.org/pulp_container/docs/admin/learn/authentication/#token-authentication) to add the complete instructions to set up with the internal authentication server provided by Django framework.

In essence it comes down to change (or to add to) the settings the following

TOKEN_SERVER='http://localhost:8080/token/'
TOKEN_SIGNATURE_ALGORITHM = 'ES256'
PUBLIC_KEY_PATH = '/etc/pulp/certs/token_public_key.pem'
PRIVATE_KEY_PATH = '/etc/pulp/certs/token_private_key.pem'

Above will redirect token request to the pulp internal token authentication, and uses also the out of the box already configured certificates at their internal path.

Also to note, and perhaps to improve. When using an external token authentication and you want to supply the keys also externally, then the keys need to be mounted and the internal mount path of the pod should be declared.

The below example silently assumes that /tmp is accessible, but that is not the default case, when running pulp in a pod

TOKEN_SERVER = "https://puffy.example.com/token/"
TOKEN_SIGNATURE_ALGORITHM = 'ES256'
PUBLIC_KEY_PATH = '/tmp/public_key.pem'
PRIVATE_KEY_PATH = '/tmp/private_key.pem'

Further down, there is also the command
http --auth-type=jwt --auth=<TOKEN> https://puffy.example.com/v2/

to get this working you must have executed first pip install httpie-jwt-auth. I can assume this is beyond the scope of the example, but it saves an online search for the package by the user

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the token-authentication section at https://pulpproject.org/pulp_container/docs/admin/learn/authentication/. Add a complete default-pod example using the internal Django token server and certificate paths, clarify that externally supplied keys must be mounted inside the pod, and mention installing httpie-jwt-auth before the example command. Done means the documentation covers both working configuration paths without relying on inaccessible /tmp files.

Written by the indexing model from the issue text.

Assessment

Tech stack
django, python
Domain
authentication, documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.