Use case

We are using docker-registry with docker_auth to provide an "anonymous pull, authenticated push" workflow. We would like to also provide a UI to help anonymous users browse things.

The way it works under the covers is that the auth service is configured to simply always grant an access token for a pull request, and the client provides the bearer token with all requests. It would be highly useful regskin was able to use the token-based workflow as well.

Basic workflow

The way the Docker clients perform the transaction is essentially:

• Attempt to fetch a "sentinel" URL (usually /v2), get an HTTP 401 back
• Parse the www-authenticate header, pull out the fields: realm, scope, service
• Run something akin to curl $realm -d 'scope=$scope' -d 'service=$service'
• The JSON response of that call will be two copies of the bearer token to use, pick one
• Resubmit the original request (and all subsequent requests) with the Authorization: Bearer $token header set

The full spec is here.