CN108011862A - The mandate of mirror image warehouse, access, management method and server and client side - Google Patents

Abstract

The present invention provides a kind of mandate of mirror image warehouse, access, management method and server, mirror image warehouse client, mirror image warehouse client sends certification request to mirror image warehouse authorization server, identity information and default identity information of the mirror image warehouse authorization server in certification request carry out authorization identifying with user role mapping table to user, and wherein different user role corresponds to different access rights；And after user's authorization identifying success, the authorization token of feedback；Mirror image warehouse client is based on the authorization token and sends mirror image resources access request to mirror image warehouse server, mirror image warehouse server judge the mirror image resources access request for authorization requests when, just further to being accessed according to the corresponding authorization token of mirror image resources access request to the mirror image resources access request processing.The present invention, which is realized, control effectively the access rights for accessing the different user in mirror image warehouse according to different user role, mirror image warehouse can be given to provide fine-grained access control.

Description

Mirror warehouse authorization, access, management methods, server and client

technical field

The invention relates to the communication field, in particular to a method for authorization, access and management of a mirror warehouse, a server and a client.

Background technique

Docker is an open source engine that makes it easy to create a lightweight, portable, self-sufficient container for any application. Docker provides a public warehouse called Docker Hub, which is used to store Docker images, and any image resources uploaded to the public warehouse are for public and free use. Therefore, public warehouses are not suitable for various application scenarios that are not fully open to the outside world, such as enterprise projects. Therefore, the creation, management and use of private mirror warehouses is particularly important. There are currently many implementations of private mirror warehouses, such as Docker Registry. But even if it is a private image warehouse, users with different user roles still need to access the image resources stored in it, such as administrators or R&D personnel or basic support personnel, etc. At present, whether it is a private mirror warehouse or a public mirror warehouse, there is a lack of effective management methods for different user access rights according to different user roles, resulting in a lack of rationality in the management of mirror warehouses, and there are certain security risks.

Contents of the invention

The embodiment of the present invention provides a mirror warehouse authorization, access, management method, server and client. The main technical problem to be solved is: to solve the problem that the existing mirror warehouse does not effectively control the access rights of different users according to different user roles .

In order to solve the above technical problems, an embodiment of the present invention provides a mirror warehouse authorization method, including:

receiving an authentication request for accessing the mirror repository sent by the mirror repository client, the authentication request at least including the user's identity information;

According to the identity information and the preset identity information and user role correspondence table, perform authorization and authentication on the user, and different user roles correspond to different access rights;

When the authorization authentication succeeds, an authorization token is fed back to the mirror repository client, so that the mirror repository client can access the mirror repository based on the authorization token.

In order to solve the above technical problems, an embodiment of the present invention provides a mirror warehouse access method, including:

Sending an authentication request to the mirror repository authorization server, the authentication request at least including the identity information of the user;

receiving the authorization token fed back by the mirror warehouse authorization server after the authorization authentication of the user is successful according to the identity information and the preset identity information and user role correspondence table;

A mirror resource access request is sent to the mirror repository server based on the authorization token.

In order to solve the above technical problems, an embodiment of the present invention provides a mirror warehouse management method, including:

Receive the mirror resource access request sent by the mirror warehouse client;

When it is determined that the mirror resource access request is an unauthorized request, an authorization authentication instruction notification is sent to the mirror warehouse client, and the authorization authentication instruction notification includes the address information of the mirror warehouse authorization server;

When it is determined that the mirror resource access request is an authorized request, access processing is performed on the mirror resource access request according to the authorization token corresponding to the mirror resource access request.

In order to solve the above technical problems, an embodiment of the present invention provides a mirror warehouse authorization server, including:

An authentication receiving module, configured to receive an authentication request sent by a mirror warehouse client for accessing a mirror warehouse, wherein the authentication request at least includes the identity information of the user;

An authorization authentication module, configured to perform authorization authentication on the user according to the identity information and the preset identity information and user role correspondence table, and different user roles correspond to different access rights;

The authentication feedback module is configured to feed back an authorization token to the mirror warehouse client when the authorization authentication is successful, so that the mirror warehouse client can access the mirror warehouse based on the authorization token.

In order to solve the above technical problems, an embodiment of the present invention provides a mirror warehouse client, including:

An authentication processing module, configured to send an authentication request to the mirror warehouse authorization server, wherein the authentication request includes at least the identity information of the user, and receive the corresponding relationship between the mirror warehouse authorization server and the user role according to the identity information and the preset identity information. After the authorization and authentication of the user is successful, the authorization token is fed back;

A resource access module, configured to send a mirror resource access request to the mirror repository server based on the authorization token.

In order to solve the above technical problems, an embodiment of the present invention provides a mirror warehouse server, including:

The access receiving module is used to receive the mirror resource access request sent by the mirror warehouse client;

A control module, configured to send an authorization authentication instruction notification to the mirror warehouse client when determining that the mirror resource access request is an unauthorized request, and the authorization authentication indication notification includes the address information of the mirror warehouse authorization server; and is used to determine that the mirror image When the resource access request is an authorized request, access processing is performed on the mirror resource access request according to the authorization token corresponding to the mirror resource access request.

The embodiment of the present invention also provides a computer storage medium, wherein computer executable instructions are stored in the computer storage medium, and the computer executable instructions are used to execute the aforementioned mirror repository authorization, access, and management methods.

The beneficial effects of the present invention are:

According to the mirror warehouse authorization, access, management method, server, client and computer storage medium provided by the embodiment of the present invention, the mirror warehouse client sends an authentication request to the mirror warehouse authorization server, and the mirror warehouse authorization server sends the authentication request according to the identity information and the identity information in the authentication request. The preset identity information and user role correspondence table performs authorization and authentication for users, wherein different user roles correspond to different access rights; and after the user authorization and authentication is successful, the authorization token fed back to the mirror warehouse client; and then the mirror warehouse The client sends a mirror resource access request to the mirror warehouse server based on the authorization token. When the mirror warehouse server determines that the mirror resource access request is an authorized request, it will further access the mirror resource according to the authorization token corresponding to the mirror resource access request. Request for access processing. Therefore, the present invention effectively controls the access rights of different users accessing the mirror warehouse according to different user roles, can provide fine-grained access control for the mirror warehouse, and improves the practicability, security and management rationality of the mirror warehouse.

Description of drawings

FIG. 1 is a schematic flow diagram of a mirror warehouse access method in Embodiment 1 of the present invention;

FIG. 2 is a schematic diagram of an authorization and authentication instruction flow in Embodiment 1 of the present invention;

FIG. 3 is a schematic flow diagram of a mirror warehouse authorization method in Embodiment 1 of the present invention;

FIG. 4 is a schematic flowchart of a method for managing a mirror warehouse in Embodiment 1 of the present invention;

FIG. 5 is a schematic structural diagram of a mirror warehouse client in Embodiment 2 of the present invention;

FIG. 6 is a schematic structural diagram of the mirror warehouse authorization server in Embodiment 2 of the present invention;

FIG. 7 is a schematic structural diagram of a mirror warehouse server in Embodiment 2 of the present invention;

FIG. 8-1 is a schematic diagram of an identity authentication method in Embodiment 3 of the present invention;

Figure 8-2 is a schematic diagram of the authorization authentication method in Embodiment 3 of the present invention;

FIG. 9 is a schematic diagram of an authorization authentication process in Embodiment 3 of the present invention;

FIG. 10 is a schematic diagram of configuration information in Embodiment 3 of the present invention.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Embodiment one:

The mirror warehouse client in this embodiment sends an authentication request to the mirror warehouse authorization server, and the mirror warehouse authorization server performs authorization authentication on the user according to the identity information in the authentication request and the preset identity information and user role correspondence table, where different user roles Corresponding to different access rights, and after the user authorization authentication is successful, the authorization token is fed back to the mirror warehouse client; and then the mirror warehouse client sends a mirror resource access request to the mirror warehouse server based on the authorization token, and the mirror warehouse server determines the When the mirror resource access request is an authorized request, the mirror resource access request is further processed according to the authorization token corresponding to the mirror resource access request. It realizes effective control of the access rights of different users accessing the mirror warehouse according to different user roles, can provide fine-grained access control for the mirror warehouse, and improves the practicability, security and management rationality of the mirror warehouse. In order to better understand the present invention, this embodiment schematically illustrates the three terminals of the mirror warehouse client, the mirror warehouse server, and the mirror warehouse authorization server respectively.

For the mirror warehouse client, it can send a mirror resource access request to the mirror warehouse server according to the command request sent by the user, and send an authentication request to the mirror warehouse authorization server according to the mirror warehouse service fed back by the mirror warehouse server; When specifying the address of the authorization server, an authentication request is sent to the mirror repository authorization server directly according to the command request sent by the user. The specific implementation method can be flexibly selected and used according to specific application scenarios. A mirror warehouse access method provided in this embodiment is shown in Figure 1, including:

S101: The mirror warehouse client sends an authentication request to the mirror warehouse authorization server, where the authentication request at least includes user identity information.

As mentioned above, the authentication request in this embodiment may be sent by the mirror repository client according to the instruction of the mirror repository server, or directly by the mirror repository client according to the instruction of the user.

S102: The mirror warehouse client receives the authorization token fed back by the mirror warehouse authorization server after the user authorization authentication is successful according to the identity information in the authentication request and the preset identity information and user role correspondence table.

In this embodiment, the identity information and user role correspondence table may be pre-configured locally on the mirror warehouse authorization server, or may be configured in a database accessible to other mirror warehouse authorization servers. In this embodiment, different user roles correspond to different access rights. In this embodiment, user roles and corresponding access rights can be set flexibly according to specific application scenarios.

S103: The mirror warehouse client sends a mirror resource access request to the mirror warehouse server based on the authorization token.

It should be understood that, in this embodiment, the manner in which the mirror repository client sends the authentication request and the mirror resource access request, as well as the specific protocol adopted can be flexibly set according to specific requirements. And the mirror warehouse in the embodiment includes but not limited to the Docker mirror warehouse.

As analyzed above, in this embodiment, before the authentication sent by the mirror warehouse client to the mirror warehouse server, the following steps shown in Figure 2 may also be included:

S201: The mirror warehouse client sends a mirror resource access request to the mirror warehouse server.

After receiving the mirror resource access request, the mirror warehouse server will first judge whether the mirror resource access request has been authorized and authenticated, and if so, perform subsequent access steps, otherwise prompt the mirror warehouse client to perform authorization and authentication.

S202: When the mirror repository client receives the authorization authentication instruction notification returned by the mirror repository server, it sends the authentication request to the mirror repository authorization server according to the mirror repository authorization server address information in the authorization authentication instruction notification.

The mirror repository authorization server address information in this embodiment may be pre-configured on the mirror repository server.

In this embodiment, the authentication request sent by the mirror repository client to the mirror repository authorization server may contain different information, which will be described below with two examples.

Example 1: The authentication request sent by the mirror warehouse client can only contain the user's identity information to complete the authorization authentication. At this time, the authorization authentication can only be authenticated based on whether the identity information is legal. It can include all the access rights of the user corresponding to the user role (access rights include but not limited to the range of image resources allowed by the user role and the range of allowed operation types); in order to further improve security, the authentication request can also include the user password , before the mirror warehouse authorization server authorizes the user according to the authentication request, it can also first authenticate the user according to the identity information, user password, and configuration file corresponding to the preset identity information and user password.

Example 2: The authentication request sent by the mirror warehouse client can include the user's identity information, the currently accessed mirror resource information (it can be the address of the currently accessed mirror resource, or the type and name of the currently accessed mirror resource), and the current The operation type of the access request; the authorization authentication at this time can be based on whether the identity information is legal, and whether the currently accessed image resource information and the operation type of the current access request are within the scope of the image resource allowed by the user role of the user ( It can be the mirror resource address range, or the mirror resource type range and name) and the allowed operation type range for authorization and authentication. Of course, in order to further improve security, the authentication request can also include the user password. Before the mirror warehouse authorization server authorizes the user according to the authentication request, it can also correspond to the user password according to the identity information, user password and preset identity information. A relational configuration file to authenticate the user.

It should be understood that, in this embodiment, the specific implementation manners of authorization authentication and identity authentication for the user are not limited to the foregoing exemplary manners.

In this embodiment, after the user in the authentication request is authorized and authenticated successfully, the issued authorization token contains the image resources that the user is allowed to access (it can be all the image resources that are allowed to be accessed corresponding to the user role of the user in the first example above) Resource, which can also be the mirror resource currently allowed to be accessed by the user role of the user in the above example 2), operation type (it can be all allowed operation types corresponding to the user role of the user in the above example 1, or the above-mentioned The type of operation currently allowed by the user role of the user in Example 2 may further include the valid time of the token, which can be flexibly set according to specific requirements, for example, set to 10 minutes, 30 minutes, etc.

The mirror repository client can use any of the following methods to send mirror resource access requests to the mirror repository server based on the authorization token:

Method 1: first send the obtained authorization token to the mirror warehouse server separately, and then send the corresponding mirror resource access request to the mirror warehouse server.

Method 2: After adding the authorization token including the mirror resource that the user is allowed to access, the type of operation, and the valid time of the token into the mirror resource access request, send it to the mirror repository server.

In this embodiment, the mirror warehouse authorization method process executed by the mirror warehouse authorization server side is shown in Figure 3, including:

S301: Receive the authentication request for accessing the mirror warehouse sent by the mirror warehouse client, the authentication request at least includes the identity information of the user (including but not limited to the user name);

S302: Authorize and authenticate the user according to the identity information in the authentication request and the preset identity information and user role correspondence table, and different user roles correspond to different access rights;

S303: When the authorization authentication succeeds, feed back an authorization token to the mirror warehouse client, so that the mirror warehouse client can access the mirror warehouse based on the authorization token. When the authorization authentication fails, you can feedback the failure prompt to the mirror warehouse client, or do not give any feedback.

As analyzed above, in order to further improve security, the authentication request sent by the mirror warehouse client in this embodiment may also include the user password; Information and user passwords, combined with the preset identity information and user password correspondence configuration file, to authenticate users. Only after the identity authentication is passed, the subsequent authorization authentication process is executed, otherwise the subsequent authorization authentication process is not executed, and the authentication failure is reported to the mirror warehouse client.

As analyzed above, the authorization authentication methods in this embodiment may include but not limited to the following two example methods:

Example 1: The authentication request sent by the mirror repository client may only contain the user's identity information. At this time, the authorization and authentication of the mirror warehouse server can only perform authorization and authentication on the user based on the identity information, combined with the preset identity information and user role correspondence table, for example, check whether the identity information exists in the identity information and user role correspondence table , if so, the authorization authentication is successful. After the authorization authentication is successful, the authorization token issued to the mirror warehouse client can contain all the access rights of the user corresponding to the user role (the access rights include but are not limited to the mirror images that the user role allows access to) resource scope and allowed operation type scope).

Example 2: The authentication request sent by the mirror warehouse client can include the user's identity information, the currently accessed mirror resource information (it can be the address of the currently accessed mirror resource, or the type and name of the currently accessed mirror resource), and the current The operation type of the access request; at this time, the authorization and authentication of the mirror warehouse server can be based on whether the identity information is legal, as well as the currently accessed image resource information and whether the operation type of the current access request is within the scope of the mirror resource that the user's user role allows access to Authorization and authentication are performed within the scope of the mirror resource address range, or the mirror resource type range and name) and the allowed operation type range.

The access rights in this embodiment include, but are not limited to, the range of image resources allowed by the user role and the range of allowed operation types. The types of operations include but are not limited to upload, download, delete, and query. For example, for administrators, it also Can have the permission to set user roles and corresponding access rights. The following is an example description of the range of operation types corresponding to user roles. See Table 1 below.

Table 1

Identity Information user role Operation Type Range username 1 administrator All operation types username 2 administrator All operation types username 3 first user role Upload, download, delete, query username 4 secondary user role Upload, download, query username 5 first user role Upload, download, delete, query username 6 third user role upload, download, delete username 7 fourth user role Upload Download username 8 fifth user role download Username 9 Sixth User Role Inquire

The range of mirror resources can be set separately for different user roles. In one example, the range of mirror resources can be limited by limiting the address range of mirror resources (for example, which addresses in which mirror warehouse), or by the type of mirror resources and name, or a combination of both.

Based on the above table 1, assuming that authentication is performed in the authentication method of the above example 2, the process of authorization authentication performed by the mirror warehouse authentication server at this time includes: according to the identity information in the authentication request, search in the preset identity information and user role correspondence table According to the user role corresponding to the user, determine whether the currently accessed image resource information is within the scope of the image resource allowed by the user role, and whether the operation type of the current access request is within the allowed operation type range, and if so, the authorization authentication is successful ; Otherwise, authorization authentication fails.

For example, suppose the identity information in the authentication request is user name 4, the current operation type is download, and the mirror resource information currently accessed is a mirror file whose resource type is repository and name is test/my-app. At this time, the authorization authentication process of the mirror warehouse authentication server includes: find the second user role corresponding to the user name 4 in Table 1, determine that the current operation type download is within the allowed operation type range, and the mirror resource currently accessed is within the allowable range. Within the scope of access, the authorization authentication is successful.

For another example, assume that the identity information in the authentication request is username 7, the current operation type is delete, and the mirror resource information currently accessed is a mirror file whose resource type is repository and name is test/my-app. At this time, the process of authorization authentication by the mirror warehouse authentication server includes: find the fourth user role corresponding to the user name 7 in Table 1, determine that the current operation type deletion is not within the allowed operation type range, and the authorization authentication fails.

For another example, assume that the identity information in the authentication request is user name 10, the current operation type is query, and the image resource information currently accessed is a mirror file whose resource type is repository and name is test/my-app. At this time, the authorization authentication process performed by the mirror warehouse authentication server includes: the user name 7 is not found in Table 1, and the authorization authentication fails.

In this embodiment, the process of the mirror warehouse management method executed on the mirror warehouse server side is shown in FIG. 4, including:

S401: Receive a mirror resource access request sent by a mirror warehouse client.

S402: Determine whether the mirror resource access request is an authorization request, if not, go to S403; otherwise, go to S404.

In this embodiment, when the mirror repository server receives a mirror resource access request including an authorization token, it also stores the authorization token after processing the mirror resource access request. In this way, when a subsequent image resource access request that does not contain an authorization token is received, it can be determined whether the image resource access request is an authorization request according to the authorization token previously stored locally.

S403: Send an authorization authentication instruction notification to the mirror warehouse client. The authorization authentication instruction notification includes the address information of the mirror warehouse authorization server. When using the above example 2 for authorization authentication, it can further include the currently accessed mirror resource information and operation type for Registry clients add this information when generating authentication requests.

S404: Perform access processing on the mirror resource access request according to the authorization token corresponding to the mirror resource access request, such as performing corresponding download, upload, delete, and query.

Corresponding to the above two example authentication methods, in this embodiment, the method of accessing the mirror resource access request according to the authorization token corresponding to the mirror resource access request also includes:

Judging whether the authorization token is currently valid according to the valid time of the token corresponding to the mirror resource access request, if invalid, send a re-authorization authentication instruction notification to the mirror warehouse client; if valid, judge whether the mirror resource information currently accessed by the mirror resource access request is valid It is within the range of image resources that are allowed to be accessed, and whether the operation type of the current access request is within the range of allowed operation types, if yes, perform access; otherwise, deny access or send a re-authorization authentication instruction notification to the mirror warehouse client.

It should be understood that, in this embodiment, various message interaction modes among the mirror warehouse client, the mirror warehouse server, and the mirror warehouse authorization server can be flexibly set. This embodiment realizes effective control of access rights of different users accessing the mirror warehouse according to different user roles, can provide fine-grained access control for the mirror warehouse, and improves the practicability, security and management rationality of the mirror warehouse.

Embodiment two:

This embodiment provides a mirror warehouse client, as shown in Figure 5, including:

The authentication processing module 51 is used to send an authentication request to the mirror warehouse authorization server, and the authentication request includes at least the identity information of the user; After the user is authorized and authenticated successfully, the authorization token that is fed back;

The authentication processing module 51 can send a mirror resource access request to the mirror warehouse server according to the command request sent by the user, and send an authentication request to the mirror warehouse authorization server according to the mirror warehouse service fed back by the mirror warehouse server; Address, send an authentication request to the mirror repository authorization server directly according to the command request sent by the user.

In this embodiment, the identity information and user role correspondence table may be pre-configured locally on the mirror warehouse authorization server, or may be configured in a database accessible to other mirror warehouse authorization servers. In this embodiment, different user roles correspond to different access rights. In this embodiment, user roles and corresponding access rights can be set flexibly according to specific application scenarios.

The resource access module 52 is configured to send a mirror resource access request to the mirror repository server based on the authorization token.

The authentication request sent by the authentication processing module 51 to the mirror repository authorization server may contain different information, which will be described below with two examples.

Example 1: The authentication request sent by the authentication processing module 51 may only contain the identity information of the user to complete the authorization authentication. At this time, the authorization authentication can only be authenticated based on whether the identity information is legal. It can include all the access rights of the corresponding user role of the user (access rights include but not limited to the range of image resources allowed by the user role and the range of allowed operation types);

Example two: the authentication request sent by the authentication processing module 51 may include the identity information of the user, the currently accessed image resource information (which may be the address of the currently accessed image resource, or the type and name of the currently accessed image resource) and the current The operation type of the access request; the authorization authentication at this time can be based on whether the identity information is legal, and whether the currently accessed image resource information and the operation type of the current access request are within the scope of the image resource allowed by the user role of the user ( It can be the mirror resource address range, or the mirror resource type range and name) and the allowed operation type range for authorization and authentication.

In order to further improve security, the authentication request can also include the user password. Before the mirror warehouse authorization server authorizes the user according to the authentication request, it can also be configured according to the identity information, user password, and the corresponding relationship between the preset identity information and the user password. file to authenticate the user.

In this embodiment, after the user in the authentication request is authorized and authenticated successfully, the issued authorization token contains the image resources that the user is allowed to access (it can be all the image resources that are allowed to be accessed corresponding to the user role of the user in the first example above) Resource, which can also be the mirror resource currently allowed to be accessed by the user role of the user in the above example 2), operation type (it can be all allowed operation types corresponding to the user role of the user in the above example 1, or the above-mentioned The type of operation currently allowed by the user role of the user in Example 2 may further include the valid time of the token, which can be flexibly set according to specific requirements, for example, set to 20 minutes, 30 minutes, etc.

The resource access module 52 can use any of the following methods to send the mirror resource access request to the mirror warehouse server based on the authorization token:

Way 1: The resource access module 52 first sends the obtained authorization token to the mirror warehouse server separately, and then sends a corresponding mirror resource access request to the mirror warehouse server.

Method 2: The resource access module 52 adds the authorization token including the mirror resource that the user is allowed to access, the operation type, and the valid time of the token into the mirror resource access request, and then sends it to the mirror repository server.

This embodiment also provides a mirror warehouse authorization server, as shown in Figure 6, including:

The authentication receiving module 61 is used to receive the authentication request sent by the mirror warehouse client for accessing the mirror warehouse, the authentication request at least includes the identity information of the user (including but not limited to the user name);

The authorization authentication module 62 is used to perform authorization authentication on the user according to the identity information and the preset identity information and user role correspondence table, and different user roles correspond to different access rights;

The authentication feedback module 63 is configured to feed back an authorization token to the mirror warehouse client when the authorization authentication is successful, so that the mirror warehouse client can access the mirror warehouse based on the authorization token. When the authorization authentication fails, you can feedback the failure prompt to the mirror warehouse client, or do not give any feedback.

In order to further improve security, the authentication request sent by the mirror warehouse client in this embodiment may also include a user password; referring to FIG. Before the user performs authorization authentication, the user can also be authenticated according to the identity information and user password, combined with the preset configuration file corresponding to the identity information and user password. Only after the identity authentication is passed, the authorization authentication module executes the subsequent authorization authentication process, otherwise it does not execute the subsequent authorization authentication process, and feedbacks the authentication failure to the mirror warehouse client.

As analyzed above, the authorization authentication methods in this embodiment may include but not limited to the following two example methods:

Example 1: The authentication request sent by the mirror repository client may only contain the user's identity information. At this time, the authorization authentication module 62 authorization authentication can only perform authorization authentication on the user based on the identity information in combination with the preset identity information and user role correspondence table, for example, check whether the identity information is in the identity information and user role correspondence table. If it exists, the authorization authentication is successful. After the authorization authentication is successful, the authorization token issued to the mirror warehouse client can contain all the access rights of the corresponding user role of the user (the access rights include but are not limited to the access rights allowed by the user role. Mirror resource scope and allowable operation type scope).

Example 2: The authentication request sent by the mirror warehouse client can include the user's identity information, the currently accessed mirror resource information (it can be the address of the currently accessed mirror resource, or the type and name of the currently accessed mirror resource), and the current The operation type of the access request; at this time, the authorization authentication module 62 authorization authentication can be based on whether the identity information is legal, and whether the mirror resource information of the current visit and the operation type of the current access request are in the mirror resource that the user role of the user allows access to Authorization and authentication are performed within the range of the mirror resource address range, or the mirror resource type range and name) and the allowed operation type range.

The access rights in this embodiment include, but are not limited to, the range of image resources allowed by the user role and the range of allowed operation types. The types of operations include but are not limited to upload, download, delete, and query. For example, for administrators, it also Can have the permission to set user roles and corresponding access rights.

This embodiment also provides a mirror warehouse server, as shown in Figure 7, including:

The access receiving module 71 is configured to receive the mirror resource access request sent by the mirror warehouse client;

The control module 72 is used to determine that the mirror resource access request is an unauthorized request, and send an authorization authentication instruction notification to the mirror warehouse client. The authorization authentication instruction notification includes the address information of the mirror warehouse authorization server. When using the above example 2 for authorization authentication, It can further include information about the currently accessed mirror resource and the type of operation for adding the information when the mirror repository client generates an authentication request; and when determining that the mirror resource access request is an authorized request, according to the corresponding The authorization token of the image resource access request is processed.

In this embodiment, when the control module 72 receives a mirror resource access request including an authorization token, it also stores the authorization token after processing the mirror resource access request. In this way, when a subsequent image resource access request that does not contain an authorization token is received, it can be determined whether the image resource access request is an authorization request according to the authorization token previously stored locally.

The control module 72 is specifically used to judge whether the authorization token is currently valid according to the valid time of the token, if invalid, send a re-authorization authentication instruction notification to the mirror warehouse client; if valid, judge the mirror resource access request Whether the currently accessed image resource information is within the scope of the image resource that is allowed to be accessed, and whether the operation type of the current access request is within the allowed operation type range, if yes, execute the access; otherwise, deny access or report to the mirror warehouse customer The terminal sends a re-authorization authentication instruction notification.

The functions of the above modules in this embodiment may be implemented by circuits or codes in the microcontroller. And obviously, each module or each step of the embodiment of the present invention can be implemented by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, optionally , they can be implemented with program codes executable by a computing device, thus, they can be stored in a computer storage medium (ROM/RAM, magnetic disk, optical disk) to be executed by a computing device, and in some cases, can be The steps shown or described may be performed in a different order than here, or they may be implemented as individual integrated circuit modules, or multiple modules or steps thereof may be implemented as a single integrated circuit module. Therefore, the present invention is not limited to any specific combination of hardware and software.

Embodiment three:

In order to better understand the present invention, the following uses the Docker mirror warehouse as an example to describe it in combination with the second example above.

The function of the identity authentication module in this embodiment is to receive an authentication request from Docker, and perform identity authentication through a specified authentication method. The authentication request in this embodiment may use HTTPS (Hyper Text Transfer Protocol Secure Socket Layer), which is used for secure HTTP (HyperText Transfer Protocol, HyperText Transfer Protocol) data transmission.

As shown in Figure 8-1, the identity authentication module can support multiple authentication methods, including but not limited to:

Static file configuration; LDAP (Lightweight Directory Access Protocol) and various databases. in:

The static file configuration method is to put the user name and encrypted password in the configuration file, and load the configuration file when the authorization device is running. The configuration file configures the current user and password, and the password adopts Bcrypt (BlowfishFile Encryption, a cross-platform file encryption tool) encryption, this method is simple to implement.

LDAP (Lightweight Directory Access Protocol, Lightweight Directory Access Protocol), which stores data in a tree-like hierarchical structure, needs to start a container running an LDAP server, and then, the authorization device configures the address of the above-mentioned LDAP server through a configuration file and other information.

For various databases, when the authorization device is started, the configuration files that configure the address and port of the database are loaded, and every operation of the mirror warehouse is authenticated by reading the user data stored in the database.

The function of the authorization authentication module in this embodiment is to issue a token according to the user in the authentication request and the requested authorization scope (including the type of resource accessed, name and specific operation type) when the identity authentication is passed, and the token passes through the JWT (JSON Web Token) authentication scheme generation, the token includes the token type (ie JWT), the signature algorithm used by the token, the issuer of the token, the validity period of the token, etc. As shown in Figure 8-2, authorization authentication methods include but are not limited to: ACL (Access Control List, Access Control List), LDAP, and various databases. in:

The ACL authorization method can be used in conjunction with the above static file configuration. In the configuration file, describe the user name and its scope of authority.

LDAP authorization can be used in conjunction with LDAP authentication.

The database authorization method can be used together with the above database authentication. Authorization through database storage data has richer usage scenarios, and users can choose the database type according to their needs.

Figure 9 shows the completion process of authorization authentication, including:

S901: The mirror warehouse client initiates a resource access request to the mirror warehouse server;

S902: the mirror warehouse server returns the authorization address and the authorization range generated according to the requested address;

S903: the mirror warehouse client sends an authentication request to the mirror warehouse authorization server with the user name and password;

S904: The mirror warehouse authorization server first authenticates the user information and the request range, and after passing the authentication, sends the authorization token token to the mirror warehouse client;

S905: The mirror warehouse client carries the token and initiates a resource access request to the mirror warehouse server again;

S906: After receiving the resource access request, the mirror repository server responds to the requested resource.

The following takes image download as an example to introduce the general Docker mirror warehouse authorization server to authenticate and authorize the Docker mirror warehouse server as follows:

First, ensure that the Docker mirror warehouse server has been started normally, and the startup loads and configures the mirror warehouse authorization server information, as shown in Figure 10, including the following information: including the mirror warehouse authorization server address, and the mirror warehouse name can also be called the service name, The name of the authorized server of the mirror warehouse is the issuer of the token, and the absolute path of the public key (used with HTTPS). The mirror warehouse authorization server must also be started, and the configuration information containing the token is loaded. The name of the authorization device must be consistent with the configuration of the Docker mirror warehouse server above, and the validity period of the token must also be configured.

The Docker mirror warehouse mirror warehouse client receives a command request from the user. For example, take the DockerRegistry mirror warehouse as an example. The mirror warehouse client uses the user name and password to log in to the Docker Registry. For example, if there is a user test currently, use the command docker login 10.11.21.22:5000,10.11.21.22:5000, which is the address of the Docker Registry.

After logging in successfully, execute the docker pull 10.11.21.22:5000:test/my-app command to download the image from the mirror warehouse server to the local Docker.

The Docker image warehouse server returns an HTTP response with status code 401 because the resource access request is not authorized by the authorization server. The response header contains the address of the authorization device and the service name. For DockerRegistry, the server name can be set to DIS- At the same time, the Registry also includes the scope of the operation. In the response message header, the value of the WWW-Authenticate header field is similar to the following format: Bearerrealm="https://ip:port/auth",service="Docker-Registry",scope ="repository:test/my-app:pull". Specifically, realm is the address of the authorization server, service is the service name, scope describes the requested resource type, resource name and operation scope, the current resource type is repository, and developers can expand the resource type and requested resource name as needed, here That is, the name of the image to be downloaded is test/my-app, and the action to be performed is to download, that is, pull. There are three types of operations here: * (indicates full permissions for mirror operations), push, pull (indicates permissions for uploading and downloading images), and pull (indicates permissions for image downloads). There can be multiple scopes, that is, multiple resources can be authorized at the same time.

The mirror warehouse client sends an authentication request to the mirror warehouse authorization server according to the above authorization information, and the request address is similar to https://ip:port/auth? service＝Docker-Registry&scope＝repository:test/my-app:pull, and use HTTP basic authentication to enter the username and password, and send an HTTPS request to the mirror warehouse authorization server. The mirror warehouse authorization server first checks the requesting user according to the configured authentication method For example, the authentication method uses a PostgreSQL database, and the device compares the requested user name and password with the user name and password stored in the database. At the same time, it queries and compares the database content for the resource type, name, and operation described in the scope. If they are consistent, continue to authorize. If they are not consistent, the authentication fails, and a response message with a status code of 401 and the reason for the authentication failure are returned.

The mirror warehouse authorization server returns a token according to the above-mentioned required scope, indicating that access rights are obtained. Return the response message body via HTTP, including the generated token.

The mirror warehouse client retries to send the resource access request to the Docker mirror warehouse server, and adds the Authorization header field in the sent message header, that is, adds Bearer and a space in front of the token value.

The Docker mirror warehouse server receives the resource access request containing the token, and performs the required operation of the mirror warehouse client requesting resources, that is, downloads the mirror image to the local Docker.

For the same request of the mirror warehouse client, it can be executed directly within the validity period of the token, without re-authentication, which improves the efficiency of the operation while ensuring security.

The mirror warehouse authorization server can be quickly and conveniently integrated with the Docker mirror warehouse. The Docker mirror warehouse has achieved fine-grained access control through the above-mentioned series of authentication and authorization steps.

To sum up, the general Docker authorization method and device realize the access control to the operation of the Docker mirror warehouse, and can be conveniently deployed in Docker through mirroring, which further improves the efficiency of the development of the Docker mirror warehouse.

The above content is a further detailed description of the embodiments of the present invention in conjunction with specific implementation modes, and it cannot be assumed that the specific implementation of the present invention is limited to these descriptions. For those of ordinary skill in the technical field of the present invention, without departing from the concept of the present invention, some simple deduction or replacement can be made, which should be regarded as belonging to the protection scope of the present invention.

Claims (13)

1. a kind of mirror image warehouse authorization method, including：

Receive mirror is used to access the certification request in mirror image warehouse as what warehouse client was sent, is included at least in the certification request The identity information of user；

According to the identity information and default identity information and user role mapping table, mandate is carried out to the user and is recognized Card, different user role correspond to different access rights；

During authorization identifying success, to the mirror image warehouse client feedback authorization token, for mirror image warehouse client's end group Access in the authorization token to the mirror image warehouse.

2. mirror image warehouse as claimed in claim 1 authorization method, it is characterised in that also close comprising user in the certification request Code；

Before carrying out authorization identifying to the user according to default identity information and user role mapping table, basis is further included The user cipher and default identity information and user cipher correspondence configuration file, authentication is carried out to the user.

3. mirror image warehouse as claimed in claim 1 or 2 authorization method, it is characterised in that further include and work as in the certification request The mirror image resources information of preceding access and the action type of current access request；Allow in the access rights comprising user role The mirror image resources scope of access and the action type scope of permission；The action type, which includes, to be uploaded, downloads, deleting, inquiring about；

According to the identity information and default identity information and user role mapping table, authorization identifying is carried out to the user Including：

The user couple is found in the default identity information and user role mapping table according to the identity information Whether the user role answered, judge the mirror image resources information of the current accessed allows the mirror image resources of access in the user role In the range of, and whether the action type of the current access request in the range of the action type of permission, if so, authorization identifying into Work(；Otherwise, authorization identifying fails.

4. a kind of mirror image warehouse access method, including：

Certification request is sent to mirror image warehouse authorization server, the identity information of user is included at least in the certification request；

Mirror image warehouse authorization server is received to close according to the identity information and default identity information are corresponding with user role It is the authorization token of feedback after table succeeds user's authorization identifying；

Mirror image resources access request is sent to mirror image warehouse server based on the authorization token.

5. mirror image warehouse as claimed in claim 4 access method, it is characterised in that send and recognize to mirror image warehouse authorization server Before card request, further include：

Mirror image resources access request is sent to mirror image warehouse server；

When receiving the authorization identifying instruction notice that the mirror image warehouse server returns, indicate to notify according to the authorization identifying In mirror image warehouse authorization server address information, send the certification request to mirror image warehouse authorization server.

6. mirror image warehouse access method as described in claim 4 or 5, it is characterised in that the authorization token, which includes, allows institute State mirror image resources, action type and the token effective time of user's access；Based on the authorization token to mirror image repository service Device, which sends mirror image resources access request, to be included：

The mirror image resources, action type and the authorization token of token effective time that allow the user to access are included by described After adding in mirror image resources access request, the mirror image warehouse server is issued.

7. a kind of mirror image warehouse management method, including：

The mirror image resources access request that receive mirror is sent as warehouse client；

Judge the mirror image resources access request for unauthorized request when, to mirror image warehouse client send authorization identifying instruction Notice, the authorization identifying instruction notice include mirror image warehouse authorization server address information；

Judge the mirror image resources access request for authorization requests when, according to the corresponding authorization token of mirror image resources access request Access the mirror image resources access request processing.

8. mirror image warehouse management method as claimed in claim 7, it is characterised in that the authorization token, which includes, allows user to visit Mirror image resources, action type and the token effective time asked；According to the corresponding authorization token pair of mirror image resources access request The mirror image resources access request processing that accesses includes：

Judge whether the authorization token is currently effective according to the token effective time, it is such as invalid, to mirror image warehouse visitor Family end sends again authorization identifying instruction notice；

As effectively, judged the mirror image resources information of the mirror image resources access request current accessed whether in the mirror image for allowing to access In scope of resource, and whether the action type of the current access request in the range of the action type of permission, if so, performing visit Ask；Otherwise, denied access or to mirror image warehouse client send again authorization identifying instruction notice.

9. a kind of mirror image warehouse authorization server, including：

Certification receiving module, the certification request for being used to access mirror image warehouse sent for receive mirror as warehouse client are described The identity information of user is included at least in certification request；

Authorization identifying module, for according to the identity information and default identity information and user role mapping table, to institute State user and carry out authorization identifying, different user role corresponds to different access rights；

Certification feedback module, for authorization identifying success when, to the mirror image warehouse client feedback authorization token, for institute Mirror image warehouse client is stated to access to the mirror image warehouse based on the authorization token.

10. mirror image warehouse as claimed in claim 9 authorization server, it is characterised in that further include and work as in the certification request The mirror image resources information of preceding access and the action type of current access request；Allow in the access rights comprising user role The mirror image resources scope of access and the action type scope of permission；The action type, which includes, to be uploaded, downloads, deleting, inquiring about；

The authorization identifying module is used for according to the identity information in the default identity information and user role correspondence The corresponding user role of the user is found in table, judges the mirror image resources information of the current accessed whether at the user angle Color allow access mirror image resources in the range of, and the action type of the current access request whether permission action type model In enclosing, if so, authorization identifying success；Otherwise, authorization identifying fails.

11. a kind of mirror image warehouse client, including：

Identification processing module, for sending certification request to mirror image warehouse authorization server, includes at least in the certification request The identity information of user, and receive mirror image warehouse authorization server according to the identity information and default identity information with After user role mapping table is to user's authorization identifying success, the authorization token of feedback；

Resource access module, for sending mirror image resources access request to mirror image warehouse server based on the authorization token.

12. a kind of mirror image warehouse server, including：

Access receiving module, the mirror image resources access request sent for receive mirror as warehouse client；

Control module, for judge the mirror image resources access request for unauthorized request when, to mirror image warehouse client send out Authorization identifying instruction notice is sent, the authorization identifying instruction notice includes mirror image warehouse authorization server address information；And use When it is authorization requests to judge the mirror image resources access request, according to the corresponding authorization token pair of mirror image resources access request The mirror image resources access request accesses processing.

13. mirror image warehouse server as claimed in claim 12, it is characterised in that the authorization token, which includes, allows user to visit Mirror image resources, action type and the token effective time asked；

The control module is used to judge whether the authorization token is currently effective according to the token effective time, such as invalid, Authorization identifying instruction notice is sent again to mirror image warehouse client；As effectively, judged the mirror image resources access request Whether the mirror image resources information of current accessed is in the range of the mirror image resources for allowing to access, and the operation of the current access request Whether type is in the range of the action type of permission, if so, performing access；Otherwise, denied access or objective to the mirror image warehouse Family end sends again authorization identifying instruction notice.