Method getAuthServiceUri

src/uri/fetchers/docker.cpp:1147–1204

Tries to obtain URI of the V2 authorization service based on the "realm", "scope" and "service" auth params from the initial "401 unauthorized" response of the Docker V2 registry (see details in https://docs.docker.com/registry/spec/auth/token). If any of the params are missing from the "WWW-Authenticate" header, this function falls back to the scheme implemented in Docker image puller (see MESOS

// repository scope on its own. Scope grammar and semantics are documented in
// https://docs.docker.com/registry/spec/auth/scope .
Future<string> DockerFetcherPluginProcess::getAuthServiceUri(
    const string& repository,
    const URI& initialUri,
    const http::Response& initialResponse,
    const http::Headers& basicAuthHeaders) const
{
  const Try<hashmap<string, string>> authParam =
    getBearerAuthParam(initialUri, initialResponse);

  if (authParam.isError()) {
    LOG(WARNING) << authParam.error();
    return Failure(authParam.error());
  }

  // `authParam` is supposed to contain the 'realm', 'service'
  // and 'scope' information for bearer authentication.
  if (authParam->contains("realm") &&
      authParam->contains("service") &&
      authParam->contains("scope")) {
    // TODO(jieyu): Currently, we don't expect the auth server to return
    // a service or a scope that needs encoding.
    return authParam->at("realm") + "?" +
      "service=" + authParam->at("service") + "&" +
      "scope=" + authParam->at("scope");
  }

  const string msg =
    "Missing 'realm', 'service' or 'scope' in header WWW-Authenticate: " +
    initialResponse.headers.at("WWW-Authenticate");

  if (!enableAuthServiceUriFallback) {
    return Failure(msg);
  }

  LOG(WARNING) << msg;

  const URI registryRootUri = getRegistryRootUri(initialUri);
  return curl(registryRootUri, basicAuthHeaders, stallTimeout)
    .then([repository, registryRootUri](const http::Response& rootResponse)
      -> Future<string> {
      const Try<hashmap<string, string>> authParam =
        getBearerAuthParam(registryRootUri, rootResponse);

      if (authParam.isError()) {
        LOG(WARNING) << authParam.error();
        return Failure(authParam.error());
      }

      if (!authParam->contains("realm")) {
        return Failure(
            "Missing 'realm' in WWW-Authenticate header obtained from " +
            stringify(registryRootUri));
      }

      return authParam->at("realm") + "?scope=repository:" + repository +
             ":pull";
    });
}