Method getAuthHeader

src/uri/fetchers/docker.cpp:1216–1253

If a '401 Unauthorized' response is received and the auth-scheme is 'Bearer', we expect a header 'Www-Authenticate' containing the auth server information. We extract the auth server information from the auth-param, and then contacts the auth server to get the token. The token will then be placed in the subsequent HTTP requests as a header. See details here: https://docs.docker.com/registry/spec/

// See details here:
// https://docs.docker.com/registry/spec/auth/token/
Future<http::Headers> DockerFetcherPluginProcess::getAuthHeader(
    const string& repository,
    const URI& uri,
    const http::Headers& basicAuthHeaders,
    const http::Response& response)
{
  const auto stallTimeout = this->stallTimeout;

  return getAuthServiceUri(repository, uri, response, basicAuthHeaders)
    .then([basicAuthHeaders, stallTimeout](const string& authServiceUri) {
      return curl(authServiceUri, basicAuthHeaders, stallTimeout)
        .then([authServiceUri](const http::Response& response)
        -> Future<http::Headers> {
          if (response.code != http::Status::OK) {
            return Failure(
                "Unexpected HTTP response '" + response.status + "' "
                "when trying to GET '" + authServiceUri + "'");
          }

          CHECK_EQ(response.type, http::Response::BODY);

          Try<JSON::Object> object = JSON::parse<JSON::Object>(response.body);
          if (object.isError()) {
            return Failure("Parsing the JSON object failed: " + object.error());
          }

          Result<JSON::String> token = object->find<JSON::String>("token");
          if (token.isError()) {
            return Failure(
                "Finding token in JSON object failed: " + token.error());
          } else if (token.isNone()) {
            return Failure("Failed to find token in JSON object");
          }

          return getAuthHeaderBearer(token->value);
        });
    });
}


} // namespace uri {