{"action":"created","issue":{"url":"https://api.github.com/repos/cesanta/docker_auth/issues/22","labels_url":"https://api.github.com/repos/cesanta/docker_auth/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/cesanta/docker_auth/issues/22/comments","events_url":"https://api.github.com/repos/cesanta/docker_auth/issues/22/events","html_url":"https://github.com/cesanta/docker_auth/issues/22","id":102000270,"number":22,"title":"Can no longer pull with docker 1.8.1 if the user only has pull access","user":{"login":"silverbp","id":455530,"avatar_url":"https://avatars.githubusercontent.com/u/455530?v=3","gravatar_id":"","url":"https://api.github.com/users/silverbp","html_url":"https://github.com/silverbp","followers_url":"https://api.github.com/users/silverbp/followers","following_url":"https://api.github.com/users/silverbp/following{/other_user}","gists_url":"https://api.github.com/users/silverbp/gists{/gist_id}","starred_url":"https://api.github.com/users/silverbp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/silverbp/subscriptions","organizations_url":"https://api.github.com/users/silverbp/orgs","repos_url":"https://api.github.com/users/silverbp/repos","events_url":"https://api.github.com/users/silverbp/events{/privacy}","received_events_url":"https://api.github.com/users/silverbp/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"rojer","id":531307,"avatar_url":"https://avatars.githubusercontent.com/u/531307?v=3","gravatar_id":"","url":"https://api.github.com/users/rojer","html_url":"https://github.com/rojer","followers_url":"https://api.github.com/users/rojer/followers","following_url":"https://api.github.com/users/rojer/following{/other_user}","gists_url":"https://api.github.com/users/rojer/gists{/gist_id}","starred_url":"https://api.github.com/users/rojer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rojer/subscriptions","organizations_url":"https://api.github.com/users/rojer/orgs","repos_url":"https://api.github.com/users/rojer/repos","events_url":"https://api.github.com/users/rojer/events{/privacy}","received_events_url":"https://api.github.com/users/rojer/received_events","type":"User","site_admin":false},"milestone":null,"comments":4,"created_at":"2015-08-19T21:13:57Z","updated_at":"2015-08-21T13:22:02Z","closed_at":"2015-08-20T10:48:15Z","body":"see\r\n\r\nhttps://github.com/docker/docker/issues/15640\r\n\r\nI guess it's supposed to return the token with the appropriate rights and it's the registries responsibility to deny access.\r\n\r\nWhich makes since from an SSO kind of implementation with a JWT.\r\n\r\nin 1.8.1 docker is requesting push and pull for just a pull, not sure why they changed that."},"comment":{"url":"https://api.github.com/repos/cesanta/docker_auth/issues/comments/133424123","html_url":"https://github.com/cesanta/docker_auth/issues/22#issuecomment-133424123","issue_url":"https://api.github.com/repos/cesanta/docker_auth/issues/22","id":133424123,"user":{"login":"deitch","id":282526,"avatar_url":"https://avatars.githubusercontent.com/u/282526?v=3","gravatar_id":"","url":"https://api.github.com/users/deitch","html_url":"https://github.com/deitch","followers_url":"https://api.github.com/users/deitch/followers","following_url":"https://api.github.com/users/deitch/following{/other_user}","gists_url":"https://api.github.com/users/deitch/gists{/gist_id}","starred_url":"https://api.github.com/users/deitch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/deitch/subscriptions","organizations_url":"https://api.github.com/users/deitch/orgs","repos_url":"https://api.github.com/users/deitch/repos","events_url":"https://api.github.com/users/deitch/events{/privacy}","received_events_url":"https://api.github.com/users/deitch/received_events","type":"User","site_admin":false},"created_at":"2015-08-21T13:22:02Z","updated_at":"2015-08-21T13:22:02Z","body":"Hmm, still not working for me, but I am not sure this is the issue. Here is the output of `docker daemon -D`\r\n\r\n````\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.602029727-04:00\" level=debug msg=\"Calling POST /auth\"\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.602099561-04:00\" level=info msg=\"POST /v1.20/auth\"\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.602348541-04:00\" level=debug msg=\"pinging registry endpoint https://reg.local/v0/\"\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.602399888-04:00\" level=debug msg=\"attempting v2 ping for registry endpoint https://reg.local/v2/\"\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.623881875-04:00\" level=debug msg=\"attempting v2 login to registry endpoint https://reg.local/v2/\"\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.623947239-04:00\" level=debug msg=\"trying \\\"bearer\\\" auth challenge with params map[realm:https://reg.local:5001/auth service:reg.local scope:]\"\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.668058639-04:00\" level=debug msg=\"error trying auth challenge \\\"bearer\\\": token auth attempt to https://reg.local/v2/ realm \\\"https://reg.local:5001/auth\\\" failed with status: 401 Unauthorized\"\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.668135216-04:00\" level=error msg=\"Handler for POST /auth returned error: no successful auth challenge for https://reg.local/v2/ - errors: [token auth attempt to https://reg.local/v2/ realm \\\"https://reg.local:5001/auth\\\" failed with status: 401 Unauthorized]\"\r\nAug 21 09:15:28 reg docker[15598]: time=\"2015-08-21T09:15:28.668185040-04:00\" level=error msg=\"HTTP Error\" err=\"no successful auth challenge for https://reg.local/v2/ - errors: [token auth attempt to https://reg.local/v2/ realm \\\"https://reg.local:5001/auth\\\" failed with status: 401 Unauthorized]\" statusCode=500\r\n````\r\n\r\nAnd my config file:\r\n\r\n````yml\r\nserver:  # Server settings.\r\n  # Address to listen on.\r\n  addr: \":5001\"\r\n  # TLS certificate and key.\r\n  certificate: \"/certs/registry.crt\"\r\n  key: \"/certs/registry.key\"\r\n\r\ntoken:  # Settings for the tokens.\r\n  issuer: \"reg.local\"  # Must match issuer in the Registry config.\r\n  expiration: 900\r\n\r\n# Static user map.\r\nusers:\r\n  # Password is specified as a BCrypt hash. Use htpasswd -B to generate.\r\n  \"admin\":\r\n    password: \"$2y$05$SirvKgES6jlgIKDqElQgAu6.3d.czANNYnyPe6SJy4exvAW0cpUjW\"\r\n  \"avid\":\r\n    # password is 12345678\r\n    password: \"$2y$05$NZ694lx3DXadnm/Z3QXo9OVc5TFbAUSlYVjN4HvT.dDNDpdpUY3SC\"\r\n  \"avi2\":\r\n    # password is 12345678\r\n    password: \"$2y$05$NZ694lx3DXadnm/Z3QXo9OVc5TFbAUSlYVjN4HvT.dDNDpdpUY3SC\"\r\n  \"\": {}  # Allow anonymous (no \"docker login\") access.\r\n\r\nacl:\r\n  # Admin has full access to everything.\r\n  - match: {account: \"admin\"}\r\n    actions: [\"*\"]\r\n  # User \"avid\" has full access to avid/* images\r\n  - match: {account: \"avid\", name: \"avid/*\"}\r\n    actions: [\"*\"]\r\n  # User \"avi2\" has full access to avi2/* images but nothing else.\r\n  - match: {account: \"avid\", name: \"avi2/*\"}\r\n    actions: [\"*\"]\r\n  # User \"avid\" has full access to it/* images\r\n  - match: {account: \"avid\", name: \"it/*\"}\r\n    actions: [\"*\"]\r\n  # All logged in users can pull all images.\r\n  - match: {account: \"/.+/\"}\r\n    actions: [\"pull\"]\r\n  # All anonymous users can pull all images.\r\n  - match: {account: \"\"}\r\n    actions: [\"pull\"]\r\n  # Access is denied by default.\r\n````\r\n\r\nI am trying to push `avid/foo` and logging in as `avid`.\r\n\r\nHowever, if I do an explicit `curl` it works:\r\n\r\n````\r\n# curl -ik --user avid:12345678 'https://localhost:5001/auth?service=reg.local&scope=repository:avid/foo:push,pull'\r\nHTTP/1.1 200 OK\r\nContent-Type: application/json\r\nDate: Fri, 21 Aug 2015 13:18:52 GMT\r\nContent-Length: 587\r\n\r\n{\"token\":\"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IkNMVUQ6TjVBSzpFRzJNOjZBR0E6VkFMQjo1MkZIOlJCTVg6SEpENDozWkxUOkI3RFM6VURRQzpPVE83In0.eyJpc3MiOiJyZWcubG9jYWwiLCJzdWIiOiJhdmlkIiwiYXVkIjoicmVnLmxvY2FsIiwiZXhwIjoxNDQwMTY0MDMyLCJuYmYiOjE0NDAxNjMxMzEsImlhdCI6MTQ0MDE2MzEzMiwianRpIjoiNDIxODQ4ODQ3NTA3NDAzMDM1NyIsImFjY2VzcyI6W3sidHlwZSI6InJlcG9zaXRvcnkiLCJuYW1lIjoiYXZpZC9mb28iLCJhY3Rpb25zIjpbInB1bGwiLCJwdXNoIl19XX0.QilpTFxv2GvT5YUATZEgIdIcWQJ6HzkSob7lbbk2BkXodcBwo8aCFC0WHc8jWREeDi3f7uvd3Hq-OcobktvQVs-skMvw2fZzSvdXNwEHf9K0Z8pnJF3M1HECw3idIncRCYP3Txjmtr07c8DGLN7eNZVINykZYS15LfgzQv7RbW4\"}\r\n````\r\n\r\nThat is true even if I try a non-existent scope. So the `curl` is working, but still getting a `401` when the docker daemon tries it. \r\n\r\n````\r\n# docker version\r\nClient:\r\n Version:      1.8.1\r\n API version:  1.20\r\n Go version:   go1.4.2\r\n Git commit:   d12ea79\r\n Built:        Thu Aug 13 02:19:43 UTC 2015\r\n OS/Arch:      linux/amd64\r\n\r\nServer:\r\n Version:      1.8.1\r\n API version:  1.20\r\n Go version:   go1.4.2\r\n Git commit:   d12ea79\r\n Built:        Thu Aug 13 02:19:43 UTC 2015\r\n OS/Arch:      linux/amd64\r\n````\r\n\r\n?"}}