mirror of
https://github.com/quay/quay.git
synced 2026-01-27 18:42:52 +03:00
b9460aa334
Implement PKCE (Proof Key for Code Exchange) for OIDC authentication to enable
support for public clients and improve OAuth security.
Changes:
- Add oauth/pkce.py with code_verifier generation and S256/plain challenge methods
- Extend OAuthService to support extra auth/token params and public clients (no client_secret)
- Implement PKCE in OIDCLoginService with code_verifier token exchange
- Store PKCE verifier in session during auth initiation (endpoints/api/user.py)
- Add get_pkce_code_verifier() helper with defensive type checking
* Encapsulates pkce_enabled check and session data extraction
* Uses isinstance(data, dict) for safe type validation
* Centralizes logic across OAuth callbacks (callback, attach, cli)
- Include example Keycloak PKCE config in local-dev/stack/config.yaml
Security improvements:
- PKCE method validation to fail fast on invalid configuration
- Defensive session data validation in OAuth callbacks
- Explicit Content-Type headers for form-encoded OAuth requests
- Optimized non-verified JWT decode (skips unnecessary key fetching)
- Exponential backoff for token exchange retries (0.5s, 1.0s, 2.0s)
Configuration:
- PKCE is opt-in via USE_PKCE config (default: disabled)
- OIDC_SERVER must end with trailing slash
- Use host.containers.internal with podman for local dev
Co-authored-by: Claude <noreply@anthropic.com>
106 lines
3.1 KiB
YAML
106 lines
3.1 KiB
YAML
SUPER_USERS:
|
|
- admin
|
|
- user1
|
|
- quayadmin
|
|
GLOBAL_READONLY_SUPER_USERS:
|
|
- quayadmin
|
|
- readonly
|
|
AUTHENTICATION_TYPE: Database
|
|
BITTORRENT_FILENAME_PEPPER: 0ee18f90-5b6d-42d2-ab5e-ec9fcd846272
|
|
BUILDLOGS_REDIS:
|
|
host: quay-redis
|
|
port: 6379
|
|
DB_URI: postgresql://quay:quay@quay-db/quay
|
|
DATABASE_SECRET_KEY: '30060361640793187613697366923211113205676925445650250274752125083971638376224'
|
|
DEFAULT_TAG_EXPIRATION: 2w
|
|
DISTRIBUTED_STORAGE_CONFIG:
|
|
default:
|
|
- LocalStorage
|
|
- storage_path: /datastorage/registry
|
|
DISTRIBUTED_STORAGE_DEFAULT_LOCATIONS: []
|
|
DISTRIBUTED_STORAGE_PREFERENCE:
|
|
- default
|
|
ENTERPRISE_LOGO_URL: /static/img/quay-horizontal-color.svg
|
|
EXTERNAL_TLS_TERMINATION: true
|
|
FEATURE_ANONYMOUS_ACCESS: true
|
|
FEATURE_SUPER_USERS: true
|
|
FEATURE_SUPERUSERS_FULL_ACCESS: true
|
|
FEATURE_APP_REGISTRY: false
|
|
FEATURE_APP_SPECIFIC_TOKENS: true
|
|
FEATURE_BUILD_SUPPORT: false
|
|
FEATURE_CHANGE_TAG_EXPIRATION: true
|
|
FEATURE_DIRECT_LOGIN: true
|
|
FEATURE_GARBAGE_COLLECTION: false
|
|
FEATURE_MAILING: false
|
|
FEATURE_PARTIAL_USER_AUTOCOMPLETE: true
|
|
FEATURE_REPO_MIRROR: true
|
|
FEATURE_REQUIRE_TEAM_INVITE: true
|
|
FEATURE_RESTRICTED_V1_PUSH: false
|
|
FEATURE_SECURITY_NOTIFICATIONS: false
|
|
FEATURE_SECURITY_SCANNER: true
|
|
FEATURE_USERNAME_CONFIRMATION: true
|
|
FEATURE_USER_CREATION: true
|
|
FEATURE_USER_LOG_ACCESS: false
|
|
FEATURE_PROXY_CACHE: true
|
|
GITHUB_LOGIN_CONFIG: {}
|
|
GITHUB_TRIGGER_CONFIG: {}
|
|
GITLAB_TRIGGER_KIND: {}
|
|
LOG_ARCHIVE_LOCATION: default
|
|
MAIL_DEFAULT_SENDER: admin@example.com
|
|
MAIL_PORT: 587
|
|
MAIL_USE_TLS: true
|
|
PREFERRED_URL_SCHEME: http
|
|
REGISTRY_TITLE: Red Hat Quay
|
|
REGISTRY_TITLE_SHORT: Red Hat Quay
|
|
REPO_MIRROR_SERVER_HOSTNAME: null
|
|
REPO_MIRROR_TLS_VERIFY: false
|
|
SECURITY_SCANNER_V4_ENDPOINT: http://localhost:6000
|
|
SECURITY_SCANNER_V4_NAMESPACE_WHITELIST:
|
|
- "clairv4-org"
|
|
SECURITY_SCANNER_ISSUER_NAME: security_scanner
|
|
SERVER_HOSTNAME: localhost:8080
|
|
SETUP_COMPLETE: true
|
|
SIGNING_ENGINE: gpg2
|
|
TAG_EXPIRATION_OPTIONS:
|
|
- 0s
|
|
- 1d
|
|
- 1w
|
|
- 2w
|
|
- 4w
|
|
TEAM_RESYNC_STALE_TIME: 60m
|
|
TESTING: false
|
|
USERFILES_LOCATION: default
|
|
USERFILES_PATH: userfiles/
|
|
USER_EVENTS_REDIS:
|
|
host: quay-redis
|
|
port: 6379
|
|
USE_CDN: false
|
|
FEATURE_QUOTA_MANAGEMENT: false
|
|
BROWSER_API_CALLS_XHR_ONLY: False
|
|
# CORS_ORIGIN: "https://stage.foo.redhat.com:1337 http://localhost:9000/"
|
|
CORS_ORIGIN:
|
|
- "https://stage.foo.redhat.com:1337"
|
|
- "http://localhost:9000"
|
|
FEATURE_UI_V2: True
|
|
FEATURE_USER_METADATA: True
|
|
# Local Keycloak OIDC provider (PKCE disabled initially)
|
|
SOMEOIDC_LOGIN_CONFIG:
|
|
SERVICE_NAME: "Keycloak"
|
|
OIDC_SERVER: "http://host.containers.internal:8081/realms/quay/"
|
|
CLIENT_ID: "quay-ui"
|
|
CLIENT_SECRET: "KbIEbjqeK73iL6zhXZLaVSOCiD5mhB3h"
|
|
LOGIN_SCOPES: ["openid", "profile", "email"]
|
|
DEBUGGING: true
|
|
USE_PKCE: true
|
|
PKCE_METHOD: "S256"
|
|
PUBLIC_CLIENT: true # omit client_secret during token request when client is public
|
|
#RHSSO_LOGIN_CONFIG:
|
|
# CLIENT_ID: stage.quay.io
|
|
# CLIENT_SECRET: SECRET
|
|
# OIDC_SERVER: https://sso.stage.redhat.com/auth/realms/redhat-external/
|
|
# SERVICE_NAME: Red Hat
|
|
# SERVICE_ICON: /static/img/RedHat.svg
|
|
# VERIFIED_EMAIL_CLAIM_NAME: email
|
|
# PREFERRED_USERNAME_CLAIM_NAME: preferred_username
|
|
# LOGIN_SCOPES: ['openid']
|