Username Invalid token for Singularity CE endpoint about sregistry

[vsoch]

I'm not familiar with that OIDC plugin or what it would mean to interact with the registry here, perhaps ask the folks that maintain it?

[pfunzowalter]

Okay, But Interestingly I can use the same tokens to interact with the registry using the Singularity Registry Client and the push and pull in this case works okay.

[vsoch]

I'm curious how that works, because it looks like this OIDC provider is a web UI based one (e.g., it redirects to an external site to login) and the interactions you are showing above are from the command line.

[pfunzowalter]

Yes, I logged in via the Web interface in the app. just that in this case using OIDC instead of SAML or the other four methods that come with the code. After a successful login using OIDC to the app in the web interface, I need to retrieve the Secrets (eg TOKEN=5027225717bf0030465db1e7099e496022c42181) by clicking the username-->token, which I eventually use when I need to push images to the registry. So to add the token for our registry endpoint I use the command line as shown above. My issue is that it looks like the token I am retrieving, in this case, is invalid when adding it to Singularity Client.

[vsoch]

I think those are two different entry points to auth - one is logging you into a web UI via a callback with a code (OIDC) https://www.pingidentity.com/en/resources/identity-fundamentals/authentication-authorization-standards/openid-connect.html and the command line is still hitting the Django auth system, but not going through that handshake.

It isn't clear to me how this plugin alters the auth flow so it's probably out of scope for me to work on it / debug. But if you look into it and find a solution, please feel free to open a PR with docs for how to add this support. Thanks!