mirror of
https://github.com/project-zot/zot.git
synced 2024-12-16 21:56:37 -05:00
336526065f
BREAKING CHANGE: repository paths are now specified under a new config key called "repositories" under "accessControl" section in order to handle "groups" feature. Previously the repository paths were specified directly under "accessControl".
This PR adds the ability to create groups of users which can be used for authZ policies, instead of just users.
{
"http": {
"accessControl": {
"groups": {
Just like the users, groups can be part of repository policies/default policies/admin policies. The 'groups' field in accessControl can be missing if there are no groups. The permissions priority is user>group>default>admin policy, verified in this order (in authz.go), and permissions are cumulative. It works with LDAP too, and the group attribute name is configurable. The DN of the group is used as the group name and the functionality is the same. All groups for the given user are added to the context in authn.go. Repository paths are now specified under a new keyword called "repositories" under "accessControl" section in order to handle "groups" feature.
Signed-off-by: Ana-Roberta Lisca <ana.kagome@yahoo.com>
90 lines
2.7 KiB
Bash
90 lines
2.7 KiB
Bash
load helpers_pushpull
|
|
|
|
function setup_file() {
|
|
# Verify prerequisites are available
|
|
if ! verify_prerequisites; then
|
|
exit 1
|
|
fi
|
|
|
|
# Download test data to folder common for the entire suite, not just this file
|
|
skopeo --insecure-policy copy --format=oci docker://ghcr.io/project-zot/golang:1.20 oci:${TEST_DATA_DIR}/golang:1.20
|
|
# Setup zot server
|
|
local zot_root_dir=${BATS_FILE_TMPDIR}/zot
|
|
local zot_config_file=${BATS_FILE_TMPDIR}/zot_config.json
|
|
local oci_data_dir=${BATS_FILE_TMPDIR}/oci
|
|
local htpasswordFile=${BATS_FILE_TMPDIR}/htpasswd
|
|
mkdir -p ${zot_root_dir}
|
|
mkdir -p ${oci_data_dir}
|
|
echo 'test:$2a$10$EIIoeCnvsIDAJeDL4T1sEOnL2fWOvsq7ACZbs3RT40BBBXg.Ih7V.' >> ${htpasswordFile}
|
|
cat > ${zot_config_file}<<EOF
|
|
{
|
|
"distSpecVersion": "1.1.0",
|
|
"storage": {
|
|
"rootDirectory": "${zot_root_dir}"
|
|
},
|
|
"http": {
|
|
"address": "127.0.0.1",
|
|
"port": "8080",
|
|
"auth": {
|
|
"htpasswd": {
|
|
"path": "${htpasswordFile}"
|
|
}
|
|
},
|
|
"accessControl": {
|
|
"repositories": {
|
|
"**": {
|
|
"anonymousPolicy": ["read"],
|
|
"policies": [
|
|
{
|
|
"users": [
|
|
"test"
|
|
],
|
|
"actions": [
|
|
"read",
|
|
"create",
|
|
"update"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"log": {
|
|
"level": "debug"
|
|
}
|
|
}
|
|
EOF
|
|
setup_zot_file_level ${zot_config_file}
|
|
wait_zot_reachable "http://127.0.0.1:8080/v2/_catalog"
|
|
}
|
|
|
|
function teardown_file() {
|
|
local zot_root_dir=${BATS_FILE_TMPDIR}/zot
|
|
local oci_data_dir=${BATS_FILE_TMPDIR}/oci
|
|
teardown_zot_file_level
|
|
rm -rf ${zot_root_dir}
|
|
rm -rf ${oci_data_dir}
|
|
}
|
|
|
|
@test "push image user policy" {
|
|
run skopeo --insecure-policy copy --dest-creds test:test --dest-tls-verify=false \
|
|
oci:${TEST_DATA_DIR}/golang:1.20 \
|
|
docker://127.0.0.1:8080/golang:1.20
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "pull image anonymous policy" {
|
|
local oci_data_dir=${BATS_FILE_TMPDIR}/oci
|
|
run skopeo --insecure-policy copy --src-tls-verify=false \
|
|
docker://127.0.0.1:8080/golang:1.20 \
|
|
oci:${oci_data_dir}/golang:1.20
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
@test "push image anonymous policy" {
|
|
run skopeo --insecure-policy copy --dest-tls-verify=false \
|
|
oci:${TEST_DATA_DIR}/golang:1.20 \
|
|
docker://127.0.0.1:8080/golang:1.20
|
|
[ "$status" -eq 1 ]
|
|
}
|