Proposal: Registry v2 authorization service

Outlines usage for endpoints which will be used by the
docker registry client for registry v2 non-standalone.

Docker-DCO-1.1-Signed-off-by: Josh Hawn <josh.hawn@docker.com> (github: jlhawn)
Thanks for clarifying - so many good proposals bubbling around it's easy to miss one.


> On Nov 12, 2014, at 5:25 PM, Olivier Gambier <notifications@github.com> wrote:
> 
> In registry/AUTH.md:
> 
> > +Instructs the server to associate the given key with the specified and authenticated account. Requires HTTP Authorization Header with basic auth (username:password) for the given account. Payload is public key with in JWK (JSON Web Key) format.
> > +
> > +Example Payload from client:
> > +
> > +```
> > +{
> > +    "kty": "EC",
> > +    "crv": "P-256",
> > +    "x": "yGnNRQwOFTbHElKcy-PUEbCSO5g6LEzKgmYJMLwwG8A",
> > +    "y": "u9FwaoJLfXAxj0Z3dHsR7Fm542XLenQw7DVrIJ2CNFc"
> > +}
> > +```
> > +
> > +## How to authenticate
> > +
> > +Today, registry clients first contact the index to initiate a push or pull. For v2, clients should contact the registry first. If the registry server requires authentication it will return a `401 Unauthorized` response with a `WWW-Authenticate` header detailing how to authenticate to this registry.
> @smarterclayton docker/docker-registry#623 - basic authentication (implemented by a proxy design in front of the registry service) is validated and will be implemented - this proposal here only covers the alternative key-based, JWT support.
> 
> So, I believe this is in line with previous discussions on that subject:
> 
> allow for third-party to plug themselves into a proxy talking basic auth with the engine
> support for a key based auth mechanism to be used at least by the Hub, and that could also be used by other people granted they would implement a matching auth service
> You are right though, this should be made more clear in that document here.
> 
> —
> Reply to this email directly or view it on GitHub.
>