Uploaded image for project: 'Project Quay'
  1. Project Quay
  2. PROJQUAY-5117

Quay calls LDAP on robot account login

XMLWordPrintable

    • False
    • None
    • False
    • Quay Enterprise

      If LDAP is set to be the auth backend, Quay will call it for both robot accounts and normal users. This was not hapenning before and it causes issues with LDAP setups that users have. For instance:

      ~/cases/inspect.local.8644177555356832513/namespaces/quay/pods# grep -i "incoming user" -rn jhb01-quay-app-78d4cfc89b-* |  cut -d "'" -f2 | sort | uniq -c
         1611 apps+mirror
      
      ~/cases/inspect.local.8644177555356832513/namespaces/quay/pods# grep -i "apps+mirror" -rn jhb01-quay-app-78d4cfc89b-* | grep "GET /v2/auth" | grep -i "skopeo" | wc -l
      3222
      

      3222 requests because we log both gunicorn-registry and nginx responses when debug logs are turned on which means exactly 1611 requests, as the previous log would suggest. This number of 1611 requests happened across a span of 3 minutes, which indicates that around 32k requests are made per hour.

      This causes disruptions in LDAP functioning. Please check!

              sleesinc Kenny Lee Sin Cheong
              rhn-support-ibazulic Ivan Bazulic
              Votes:
              0 Vote for this issue
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: