How to have both machines and people authentication?

[peter-facko]

Hello,

how do I solve the following with zot?

I want an OCI registry, where there are these users:

• one machine user machine-writer (automatic pipeline)
• one machine user machine-reader (kubernetes image pull)
• many person users person-*, authenticate through OIDC

Can I mix htpasswd for machines with OIDC for people? Or do I somehow make the machines authenticate through OIDC?

[rchincha]

https://developers.onelogin.com/openid-connect/api/client-credentials-grant
^ you probably want this, and would standardize around oidc.

[peter-facko]

@andaaron, thank you for the explanation.

What about TLS authentication? Postgres and EMQX MQTT broker, for example, can use the CN from the certificate for getting the username. The docs https://zotregistry.dev/v2.1.10/articles/authn-authz/#mutual-tls-authentication mention TLS authn, but I am not sure it is meant in that way.

[andaaron]

The MTLS authentication code flow is used as fallback only if both basic and bearer auth are disabled and no anonymous policies are set. This code is very old, and should probably be reevaluated from use-case perspective. I do not know if anyone is using it right now.

Sorry I forgot about it when replying above.

[peter-facko]

I think it's useful for machine authentication. Security-wise, TLS is needed anyway, and SPIFFE provides a way to use it for machine authn.

But to coexist with human authn, some mechanism is needed to still use for example OIDC for humans. That's why I asked about having two instances. If mTLS authn worked as I imagined, with a username mapping, I could have two zot instances pointed to the same S3. One would be for machines with mTLS authn set up, and the other for humans with OIDC and the UI.

[andaaron]

I believe the common name in the certificate is used as username when checking authorization.

[andaaron]

You should also check this out #3085.

[rchincha]

Discussion tracked with #3085
Pls test.