Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-4776

Quay 3.8.0 LDAP users are not restricted when only enabled FEATURE_RESTRICTED_USERS

XMLWordPrintable

    • False
    • None
    • False

      Description:

      This is an issue of Quay 3.8.0 new feature "restricted users", when enabled Quay to LDAP authentication and enabled flag "FEATURE_RESTRICTED_USERS: true", found all LDAP users are not restricted, as expected in this condition, all LDAP users should be restricted.

      FEATURE_RESTRICTED_USERS: true 

      Deliverable: "if the auth is LDAP and you enable the feature flag, it will apply to all users unless they are on the whitelist"

      Quay Image: quay-operator-bundle-container-v3.8.0-121

      LDAP users is not restricted when enabled "FEATURE_RESTRICTED_USERS"

      Quay config.yaml:

      ALLOW_PULLS_WITHOUT_STRICT_LOGGING: false
      ALLOWED_OCI_ARTIFACT_TYPES:
        application/vnd.cncf.helm.config.v1+json:
        - application/tar+gzip
        application/vnd.oci.image.layer.v1.tar+gzip+encrypted:
        - application/vnd.oci.image.layer.v1.tar+gzip+encrypted
      AUTHENTICATION_TYPE: LDAP
      BUILDLOGS_REDIS:
        host: quay380-quay-redis
        port: 6379
      CREATE_NAMESPACE_ON_PUSH: true
      CREATE_PRIVATE_REPO_ON_PUSH: true
      DATABASE_SECRET_KEY: QXXcAUmEpEURS10x3Oa7Yb7vIVKZGQSHuqaXX91CoMGsIWtmrQ97fPW-Ro3HNNSinCjuBfMYq1r67NVz
      DB_CONNECTION_ARGS:
        autorollback: true
        threadlocals: true
      DB_URI: postgresql://quay380-quay-database:tfbOSwKfnYkW4EAWVMwHAEVYSaxf1CMgS9sIJF0zYaDHGPidj4FBHfidyajy-CrH1PqFczQeDF5bkl18@quay380-quay-database:5432/quay380-quay-database
      DEFAULT_SYSTEM_REJECT_QUOTA_BYTES: 902400000
      DEFAULT_TAG_EXPIRATION: 4w
      DISTRIBUTED_STORAGE_CONFIG:
        default:
        - S3Storage
        - host: s3.us-east-2.amazonaws.com
          s3_access_key: ******
          s3_bucket: quay380
          s3_secret_key: ******
          storage_path: /quay380
      DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS:
      - default
      DISTRIBUTED_STORAGE_PREFERENCE:
      - default
      ENTERPRISE_LOGO_URL: /static/img/RH_Logo_Quay_Black_UX-horizontal.svg
      EXTERNAL_TLS_TERMINATION: true
      FEATURE_BUILD_SUPPORT: false
      FEATURE_DIRECT_LOGIN: true
      FEATURE_EXTENDED_REPOSITORY_NAMES: true
      FEATURE_GENERAL_OCI_SUPPORT: true
      FEATURE_HELM_OCI_SUPPORT: true
      FEATURE_MAILING: false
      FEATURE_PROXY_CACHE: true
      FEATURE_QUOTA_MANAGEMENT: true
      FEATURE_REPO_MIRROR: true
      FEATURE_RESTRICTED_USERS: true
      FEATURE_SECURITY_NOTIFICATIONS: true
      FEATURE_SECURITY_SCANNER: true
      FEATURE_USER_INITIALIZE: true
      LDAP_ADMIN_DN: cn=admin,dc=example,dc=org
      LDAP_ADMIN_PASSWD: admin
      LDAP_ALLOW_INSECURE_FALLBACK: false
      LDAP_BASE_DN:
      - dc=example
      - dc=org
      LDAP_EMAIL_ATTR: mail
      LDAP_UID_ATTR: uid
      LDAP_URI: ldap://quayldap.qe.devcluster.openshift.com
      LDAP_USER_RDN:
      - ou=usateam
      PREFERRED_URL_SCHEME: https
      REGISTRY_TITLE: Red Hat Quay
      REGISTRY_TITLE_SHORT: Red Hat Quay
      REPO_MIRROR_INTERVAL: 30
      REPO_MIRROR_TLS_VERIFY: true
      SECRET_KEY: k02wE02lITPRBBrcBOPihJkgkY-uDtlnrPVlr6QSgduuIyvuj0ytrA53lQe963S1n4pCzIn-OkAhXaNz
      SECURITY_SCANNER_INDEXING_INTERVAL: 30
      SECURITY_SCANNER_V4_ENDPOINT: http://quay380-clair-app.quay-enterprise-13401.svc.cluster.local
      SECURITY_SCANNER_V4_NAMESPACE_WHITELIST:
      - admin
      SECURITY_SCANNER_V4_PSK: V3VKTG9KS1lINFEycENqR3dGVzhoOGpPMWp0Mi1XQ2g=
      SERVER_HOSTNAME: quay380-quay-quay-enterprise-13401.apps.quaytest-13401.qe.devcluster.openshift.com
      SETUP_COMPLETE: true
      SUPER_USERS:
      - quay
      TAG_EXPIRATION_OPTIONS:
      - 2w
      - 4w
      - 8w
      TEAM_RESYNC_STALE_TIME: 60m
      TESTING: false
      USER_EVENTS_REDIS:
        host: quay380-quay-redis
        port: 6379
      USERFILES_LOCATION: default
      USERFILES_PATH: userfiles/ 

       

       

        1. image-2022-11-25-13-59-49-665.png
          304 kB
          luffy zhang
        2. image-2022-11-25-14-55-34-223.png
          581 kB
          luffy zhang
        3. image-2022-11-29-10-54-08-244.png
          201 kB
          luffy zhang

              sleesinc Kenny Lee Sin Cheong
              lzha1981 luffy zhang
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: