mirror of
https://github.com/quay/quay.git
synced 2026-01-26 06:21:37 +03:00
b9460aa334
Implement PKCE (Proof Key for Code Exchange) for OIDC authentication to enable
support for public clients and improve OAuth security.
Changes:
- Add oauth/pkce.py with code_verifier generation and S256/plain challenge methods
- Extend OAuthService to support extra auth/token params and public clients (no client_secret)
- Implement PKCE in OIDCLoginService with code_verifier token exchange
- Store PKCE verifier in session during auth initiation (endpoints/api/user.py)
- Add get_pkce_code_verifier() helper with defensive type checking
* Encapsulates pkce_enabled check and session data extraction
* Uses isinstance(data, dict) for safe type validation
* Centralizes logic across OAuth callbacks (callback, attach, cli)
- Include example Keycloak PKCE config in local-dev/stack/config.yaml
Security improvements:
- PKCE method validation to fail fast on invalid configuration
- Defensive session data validation in OAuth callbacks
- Explicit Content-Type headers for form-encoded OAuth requests
- Optimized non-verified JWT decode (skips unnecessary key fetching)
- Exponential backoff for token exchange retries (0.5s, 1.0s, 2.0s)
Configuration:
- PKCE is opt-in via USE_PKCE config (default: disabled)
- OIDC_SERVER must end with trailing slash
- Use host.containers.internal with podman for local dev
Co-authored-by: Claude <noreply@anthropic.com>
94 lines
2.2 KiB
Plaintext
94 lines
2.2 KiB
Plaintext
version: "3.7"
|
|
volumes:
|
|
quay-db-data:
|
|
clair-db-data:
|
|
|
|
services:
|
|
quay-db:
|
|
user: postgres
|
|
container_name: quay-db
|
|
image: docker.io/library/postgres:12.1
|
|
environment:
|
|
POSTGRES_USER: "quay"
|
|
POSTGRES_PASSWORD: "quay"
|
|
POSTGRES_DB: "quay"
|
|
volumes:
|
|
- "./local-dev/init/pg_bootstrap.sql:/docker-entrypoint-initdb.d/pg_bootstrap.sql"
|
|
- "quay-db-data:/var/lib/postgresql/data"
|
|
ports:
|
|
- "5432:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U quay -d quay"]
|
|
interval: 10s
|
|
timeout: 9s
|
|
retries: 3
|
|
start_period: 10s
|
|
|
|
clair-db:
|
|
user: postgres
|
|
container_name: clair-db
|
|
image: docker.io/library/postgres:12.1
|
|
environment:
|
|
POSTGRES_USER: "clair"
|
|
POSTGRES_DB: "clair"
|
|
volumes:
|
|
- "clair-db-data:/var/lib/postgresql/data"
|
|
ports:
|
|
- "5433:5432"
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U clair -d clair"]
|
|
interval: 10s
|
|
timeout: 9s
|
|
retries: 3
|
|
start_period: 10s
|
|
cpus: 2
|
|
|
|
redis:
|
|
user: nobody
|
|
container_name: quay-redis
|
|
image: docker.io/library/redis:latest
|
|
ports:
|
|
- "6379:6379"
|
|
|
|
quay:
|
|
user: ${DOCKER_USER:-nobody:0}
|
|
container_name: quay-quay
|
|
build:
|
|
context: .
|
|
target: final
|
|
image: localhost/quay-local:latest
|
|
volumes:
|
|
- "./data:/quay-registry/data"
|
|
- "./endpoints:/quay-registry/endpoints"
|
|
- "./local-dev/stack:/quay-registry/conf/stack"
|
|
ports:
|
|
- "8080:8080"
|
|
- "8443:8443"
|
|
environment:
|
|
QUAY_VERSION: local-dev
|
|
QUAY_HOTRELOAD: "true"
|
|
DEBUGLOG: "true"
|
|
IGNORE_VALIDATION: "true"
|
|
QUAYRUN: /tmp
|
|
WORKER_COUNT_UNSUPPORTED_MINIMUM: "1"
|
|
WORKER_COUNT: "1"
|
|
|
|
# clair is configured to share it's network
|
|
# namespace with quay. this allows quay to serve
|
|
# layers to clair over localhost.
|
|
clair:
|
|
user: nobody
|
|
container_name: quay-clair
|
|
image: quay.io/projectquay/clair:4.7.2
|
|
volumes:
|
|
- "./local-dev/clair:/src/clair/"
|
|
environment:
|
|
CLAIR_CONF: "/src/clair/config.yaml"
|
|
CLAIR_MODE: "combo"
|
|
network_mode: "service:quay"
|
|
cpus: 2
|
|
command:
|
|
["bash", "-c", "cd /src/clair/cmd/clair; go run -mod vendor ."]
|
|
depends_on:
|
|
- quay
|