OCI Authentication and Authorization Working Group

# OCI Authentication and Authorization Working Group - [OCI Calendar](https://calendar.google.com/calendar/b/2/r?cid=bGludXhmb3VuZGF0aW9uLm9yZ19pMHNhZG8waTM3ZWtuYXI1MXZzdThtZDVoZ0Bncm91cC5jYWxlbmRhci5nb29nbGUuY29t) - [Conference URL](https://zoom.us/j/6449415895?pwd=S2tJVGVra0dYdlZCRjJwdXdPdGRQQT09) with embedded passcode - One tap mobile [+16465588656,,6449415895#](+16465588656,,6449415895#) US (New York) [+16699006833,,6449415895#](+16699006833,,6449415895#) US (San Jose) Passcode: 77777 *(5 7's)* Dial by your location +1 646 558 8656 US (New York) +1 669 900 6833 US (San Jose) 877 369 0926 US Toll-free 855 880 1246 US Toll-free Meeting ID: 644 941 5895 Find your local number: https://zoom.us/u/aLDk4OXTu - [WG Approval and overview](https://github.com/opencontainers/tob/blob/main/proposals/wg-auth.md) *template at the bottom* ## May 7, 2024 - TBD Canceled future meetings pending progress on submitting proposals. ## April 30, 2024 **Recording**: https://youtu.be/aDVFgvpJIb8 ### Attendees - Brandon Mitchell - Nathan Anderson ### Notes - No updates, ended the meeting early ## April 23, 2024 Canceled ## April 16, 2024 Canceled for OSSummit ## April 9, 2024 Canceled ## April 2, 2024 **Recording**: https://youtu.be/MBDk1D6j_vM ### Attendees - Brandon Mitchell - Nathan Anderson - Jeff Carter - _add yourself_ ### Notes - No updates, ended the meeting early ## March 26, 2024 **Recording**: https://youtu.be/eNscSLlzobE ### Attendees - Brandon Mitchell - Nathan Anderson - Jeff Carter - Sajay Antony - _add yourself_ ### Notes - Quick checkin, next steps would be creating proposals in the wg-auth repo once people have free time. ## March 19, 2024 Canceled - KubeCon EU ## March 12, 2024 Canceled - no agenda ## March 5, 2024 **Recording**: https://youtu.be/3DEm5Nd07Tg ### Attendees - Nathan Anderson - Brandon Mitchell - Victor Lu - Jeff Carter - Ramkumar Chinchani - _add yourself_ ### Notes - No agenda, meeting ended early. ## February 27, 2024 **Recording**: https://youtu.be/5B4F9CLJfBo ### Attendees - Brandon Mitchell - Ramkumar Chinchani - Sajay Antony - Jeff Carter - Nathan Anderson - _add yourself_ ### Notes - No agenda, meeting ended early. ## February 20, 2024 **Recording**: https://youtu.be/J3Ms2qM8uMM ### Attendees - Brandon Mitchell - Nathan Anderson - Sajay Antony - _add yourself_ ### Notes - No agenda, meeting ended early. - Current focus of the maintainers is working through image and distribution spec backlogs after the 1.1.0 releases. ## February 13, 2024 **Recording**: https://youtu.be/4UmmL3Fyp74 ### Attendees - Brandon Mitchell - Nathan Anderson - Sajay Antony - Ramkumar Chinchani - Toddy - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - https://toddysm.com/2024/02/12/authenticating-with-oci-registries-github-container-registry-ghcr-implementation/ [@toddysm ??] - _add your items_ ### Notes - _add your notes_ ## February 6, 2024 **Recording**: https://youtu.be/V33E4iidKPE ### Attendees - Toddy - Brandon Mitchell - Nathan Anderson - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Toddy continues work on reviewing existing registry implementations. - _add your notes_ ## January 30, 2024 **Recording**: https://youtu.be/FgZNM0ybrxY ### Attendees - Brandon Mitchell - Syed Ahmed - Nathan Anderson - Jeff Carter - Toddy - Sajay Antony - Ramkumar Chinchani - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - Toddy: <https://toddysm.com/2024/01/30/authenticating-with-oci-registries-docker-hub-implementation/> - _add your items_ ### Notes - _add your notes_ ## January 23, 2024 **Recording**: https://youtu.be/DbwZoaPf7Y0 ### Attendees - Brandon Mitchell - Toddy - Nathan Anderson - Syed Ahmed - Jeff Carter - Ramkumar Chinchani - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Toddy asked about reusing a token - Described in <https://github.com/opencontainers/wg-auth/pull/11> - Ended early due to lack of agenda - _add your notes_ ## January 16, 2024 **Recording**: https://youtu.be/u7-KVNFXtX0 ### Attendees - Brandon Mitchell - Nathan Anderson - Jeff Carter - Ramkumar Chinchani - Sajay Antony - Syed Ahmed - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Auth scopes for cross repo actions like search - Quay and Docker Hub allows global actions but only to public repos - Adding search to private repos may not be supported by most registries - Some registries are looking at wildcard or prefix options for access to an organization - Browser use case - CORS issues - Desire to implement something like <https://explore.ggcr.dev/> within the browser rather than on a server - Registries that want to allow any client would need to allow a `*` origin - _add your notes_ ## January 9, 2024 **Recording**: https://youtu.be/nGn2T4OMjug ### Attendees - Brandon Mitchell - Jeff Carter - Ramkumar Chinchani - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Not much this week - Brandon will work on submitting a PR for added use cases. - _add your notes_ ## December 19, 2023 **Recording**: https://youtu.be/iH2h067qf9M ### Attendees - Brandon Mitchell - Jeff Carter - Victor Lu ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Canceled next two meetings, resuming on January 9th. - Brandon will work on pushing a PR to the use cases doc. - _add your notes_ ## December 12, 2023 **Recording**: https://youtu.be/0E_xnI_-17c ### Attendees - Brandon Mitchell - Nathan Anderson - Syed ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - _add your notes_ ## December 5, 2023 **Recording**: https://youtu.be/A_Hf18A0dxw ### Attendees - Ramkumar Chinchani - Nathan Anderson - Victor Lu - Jeff Carter - Brandon Mitchell - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Reviews for PRs are needed. - _add your notes_ ## November 28, 2023 ### Attendees - Brandon Mitchell - Lindsey Albery - Nathan Anderson ### Notes - Canceled, no agenda ## November 21, 2023 **Recording**: https://youtu.be/IdjU7h73ZpE ### Attendees - Wayne - Brandon Mitchell - Victor Lu - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - containerd implementation: <https://github.com/opencontainers/wg-auth/pull/9> ### Notes - Device authentication / zero trust discussion: - <https://trustedcomputinggroup.org/wp-content/uploads/TCG-DICE-Arch-Implicit-Identity-Based-Device-Attestation-v1-rev93.pdf> - <https://www.hashicorp.com/resources/introduction-to-zero-trust-security> ## November 14, 2023 **Recording**: https://youtu.be/iJ36wUIXyQs ### Attendees - Lindsey Albery - Bjorn Neergaard - Nathan Anderson - Brandon Mitchell - Toddy - Jeff Carter - Mike Brown (IBM) - Ramkumar Chinchani - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Discussing scenarios: - From the WG proposal: - Define registry responses to unauthenticated requests. - Define supported authentication methods (e.g. basic and bearer authentication). - Specify how clients negotiate access a repository and different types of access to that repository (e.g. pull and push). - Specify how clients negotiate access to multiple repositories for actions like a cross-repository blob mount. - Specify how clients and registries should renegotiate access for a request with expired or insufficient authorization. - Specify expected lifetime of registry credentials. - Avoid specifications that would prevent future extensibility (e.g. fine grain access control). - The authentication methods defined as supported should include OSS solution(s) that avoid picking/choosing a limited set of specific authentication providers as the default / winner. - Specify how clients and registries should be extensible/pluggable with respect to supported authentication methods. - Pull (head) followed by a push - First token is for a pull scope - On push: registry needs to send a 401 for a new scope rather than 403 of refused / insufficient scope - Should clients or servers track a forbidden scenario? - Servers may not track missing scopes today, but could be added - Clients know the scopes they've requested, but gets away from oauth 2.0 spec design - Cross repository blob mount - Do clients request both push to target and pull from source, or only push? - More research needed - URL redirect - Should auth header exist in redirect? No - URL will typically include any auth (if needed) from the remote server - Delete access - Should client generated action be pull or delete? - This assumes we define client generated scopes. - Oauth spec: <https://datatracker.ietf.org/doc/html/rfc6750> - _add your notes_ ## November 7, 2023 **Recording**: https://youtu.be/vTS29GuEbms ### Attendees - Ethan Hill - Wayne - Bjorn Neergaard - Nathan Anderson - Brandon Mitchell - Ramkumar Chinchani - Jeff Carter - Wayne - Victor Lu - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - regclient implementation: <https://github.com/opencontainers/wg-auth/pull/8> - Future plans: - containerd will hopefully have a write-up in the next week or so - gather a list of difficult auth questions we should resolve (pull then push, multi-repository access, etc) - ### Notes - _add your notes_ ## October 31, 2023 **Recording**: https://youtu.be/BfKUHT5z1jM ### Attendees - Sajay Antony - Nathan Anderson - Ramkumar Chinchani - Brandon Mitchell - Jeff Carter - Wayne - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - ORAS implementation: <https://github.com/opencontainers/wg-auth/pull/7> - _add your items_ ### Notes - _add your notes_ ## October 24, 2023 **Recording**: https://youtu.be/Mev5v_8dia4 ### Attendees - Nathan Anderson - Victor Lu - Brandon Mitchell - Sajay Antony - Ramkumar Chinchani - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - No implementation docs ready this week - Potential issues: - 307(redirect) should not include credentials in header, but may need them in the redirect URL - how do servers know when a client has requested and failed to get access to a specific repo (vs reuse the token from a different repo and need to reauth) - _add your notes_ ## October 17, 2023 **Recording**: https://youtu.be/3v1IVQPffRk ### Attendees - Toddy - Wayne Warren - Sajay Antony - Ramkumar Chinchani - Brandon Mitchell - Jeff Carter - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - No implementation docs ready this week, ended early ## October 10, 2023 **Recording**: https://youtu.be/Pnzh8UDErBM ### Attendees - Brandon Mitchell - Sajay Antony - Nathan Anderson - Victor Lu - Wayne - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Quick check-in, no updates on workflows this week - AIP: <https://google.aip.dev/general> - AEP: <https://aep.dev/general> - Action: still in progress: - Containerd (Nathan) - ORAS (Sajay will request from the team) - regclient (Brandon) - _add your notes_ ## October 3, 2023 **Recording**: https://youtu.be/5Xis39EWfvE ### Attendees - Nathan Anderson - Ramkumar Chinchani - ToddySM - Sajay Antony ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - _add your notes_ ## September 26, 2023 **Recording**: https://youtu.be/IAVvalKd9xU ### Attendees - Toddy - Nathan Anderson - Jeff Carter - Brandon Mitchell - Sajay Antony - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - Moby/Docker workflow: <https://github.com/opencontainers/wg-auth/pull/6> - _add your items_ ### Notes - Reviewed moby workflow, expect containerd to look very different - Question on how clients handle requests to multiple repositories when they have auth token for only one (should they request a new token) - Action: make workflows for: - Containerd (Nathan) - ORAS (Sajay will request from the team, expect 3-4 weeks) - regclient (Brandon, will not be here next week) - _add your notes_ ## September 19, 2023 **Recording**: https://youtu.be/u9hWTd30nsM ### Attendees - Brandon Mitchell - Sajay Antony - Nathan Anderson - Márk Sági-Kazár - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - Short review of Moby calling the /v2/ ping - Brandon will work on documenting some client's existing workflows as PRs - _add your items_ ### Notes - _add your notes_ ## September 12, 2023 **Recording**: https://youtu.be/QqUGPirVioM ### Attendees - ToddySM - Nathan Anderson - Sajay Antony ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - Discussion on creating some documentations of various registries (toddysm) - Introspection of the WWW-Authenticate challenge header (Nathan) - _add your items_ ### Notes - _add your notes_ ## September 5, 2023 **Recording**: https://youtu.be/2dz977xVuyE ### Attendees - Bradon Mitchell - Ramkumar Chinchani - Nathan Anderson - Jeff Carter - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - Could we add docker authentication specifications as a proposal? [sajay] - Does seem like a place to start with, maybe a single doc. - _add your items_ ### Notes - Deferred to next week: look at containerd / distribution / moby code with the v2 ping and the workflow to generate scopes. - _add your notes_ ## August 29, 2023 **Recording**: https://youtu.be/3JN0RXRcqII ### Attendees - Brandon Mitchell - Sajay Antony - Jeff Carter - Ramkumar Chinchani - Nathan Anderson - _add yourself_ ### Actionable Agenda Items - Meeting minutes, PR 2: <https://github.com/opencontainers/wg-auth/pull/2> - Specs and use cases, PR 3: <https://github.com/opencontainers/wg-auth/pull/3> - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - Reviewing RFC7235: <https://datatracker.ietf.org/doc/html/rfc7235> - Reviewing Docker docs: <https://docs.docker.com/registry/spec/auth/> - Next week: look at distribution code with the v2 ping and the workflow to generate scopes. - _add your notes_ ## August 22, 2023 No agenda, canceled ## August 15, 2023 **Recording**: https://youtu.be/xDSYtigDmC0 ### Attendees - Brandon Mitchell - Jeff Carter - Ramkumar Chinchani - TodySM - Victor Lu - Nathan Anderson - Sajay Antony - Aviral Takkar - _add yourself_ ### Actionable Agenda Items - None ### Presentation/Discussion Agenda Items - None ### Notes - Brainstorming - would cloud providers and others adopt proposals from here. - Potentially add a conformance test - Make additions to the conformance test. - Will we need a security review? - OCI may not have the resources, but registry servers should - Existing specs listed in PR 3: <https://github.com/opencontainers/wg-auth/pull/3/files> - Next steps? - Create a diagram of existing workflow with the docker spec - Survey of existing tools and their processes - _add your notes_ ## August 8, 2023 **Recording**: https://youtu.be/lzMrS7nYfZg ### Attendees - Aviral - Brandon Mitchell - Jeff Carter - Mike Brown (IBM) - Nathan Anderson - Ramkumar Chinchani - ToddySM ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - Repo has been created: <https://github.com/opencontainers/wg-auth> - _add your items_ ### Notes - How to handle disagreements in the WG - Hopefully we won't have many - Everything we create goes through various approvals upstream. - Separate the use cases by current capabilities vs future features - Use Cases: - Permissions to access `_catalog` - How to filter out repos from list you do not have access to - How to query limited private scope - UI authentication vs client tooling/CLI workflow - Different types of credentials (passwords, tokens) - Authentication to extensions in the registry (not only push/pull) - Authentication for anything that is not specific to a repository - Pull/push an image - Cross repository blob mount - Long running clients (registry mirroring, caches) - Timeout of stale credentials - Accessing multiple repositories - Multi-tenant clients - Encryption/decryption images/artifacts - CDN integration - Various auth methods (token, basic) - Artifact scanning and signing - Certificate authority - Mutual TLS - Auth to the tag level, e.g. embargoed fixes - HTTP redirection (when should client allow?) - Anonymous access - Will we create a library in OCI? - Existing Specs - Docker: <https://docs.docker.com/registry/spec/auth/> - HTTP RFCs: - HTTP Auth: <https://datatracker.ietf.org/doc/html/rfc7235> - OIDC: <https://datatracker.ietf.org/doc/html/rfc6749> - mTLS: <https://datatracker.ietf.org/doc/html/rfc8120> and <https://datatracker.ietf.org/doc/html/rfc8705> ## August 1, 2023 **Recording**: https://youtu.be/2SOCMLIdg10 ### Attendees - Brandon Mitchell - Jason Hall - Aviral Takkar - Jeff Carter - Sajay Antony - Josh Dolitsky - Nathan Anderson - Victor Lu - Vincent Batts - _add yourself_ ### Actionable Agenda Items - None ### Presentation/Discussion Agenda Items - Discuss what the participants would like to see out of this group - Procedural questions - Where to iterate and file issues etc. - _add your items_ ### Notes - [Repo creation request](https://github.com/opencontainers/tob/issues/127) - Josh: Jon (who isn't here) once shared this image with me and it changed my life <https://raw.githubusercontent.com/google/go-containerregistry/main/images/credhelper-basic.svg> - Jason: Consider adding docker authentication docs as a baseline and add to it if thats possibly - Jason: document the state of the world is the milestone. And really restrain on improving the state of the world? - Josh: <https://github.com/google/go-containerregistry/blob/ea19b579661d99bc753c92e93730b8aab6ecd31b/pkg/authn/README.md#the-registry> - Next steps / Action Items: - New repo creation - Document the Docker spec as it exists today - Gather use cases not covered by the existing Docker spec - Gather IETF/HTTP specs that can be leveraged - _add your notes_ ## Template ## Meeting Date ### Attendees - _add yourself_ ### Actionable Agenda Items - _add your items_ ### Presentation/Discussion Agenda Items - _add your items_ ### Notes - _add your notes_

Syntax	Example	Reference
# Header	Header	基本排版
- Unordered List	Unordered List
1. Ordered List	Ordered List
- [ ] Todo List	Todo List
> Blockquote	Blockquote
Bold font	Bold font
Italics font	Italics font
~~Strikethrough~~	~~Strikethrough~~
19^th^	19^th
H~2~O	H₂O
++Inserted text++	Inserted text
==Marked text==	Marked text
[link text](https:// "title")	Link
![image alt](https:// "title")	Image
`Code`	`Code`	在筆記中貼入程式碼
```javascript var i = 0; ```	`var i = 0;`
:smile:		Emoji list
{%youtube youtube_id %}	Externals
$L^aT_eX$	L^aT_eX
:::info This is a alert area. :::	This is a alert area.