Chapter 4. OCI referrers OAuth access token
In some cases, depending on the features that your Red Hat Quay deployment is configured to use, you might need to leverage an OCI referrers OAuth access token. OCI referrers OAuth access tokens are used to list OCI referrers of a manifest under a repository, and uses a curl
command to make a GET
request to the Red Hat Quay v2/auth
endpoint.
These tokens are obtained via basic HTTP authentication, wherein the user provides a username and password encoded in Base64 to authenticate directly with the v2/auth
API endpoint. As such, they are based directly on the user’s credentials aod do not follow the same detailed authorization flow as OAuth 2, but still allow a user to authorize API requests.
OCI referrers OAuth access tokens do not offer scope-based permissions and do not expire. They are solely used to list OCI referrers of a manifest under a repository.
Additional resource
4.1. Creating an OCI referrers OAuth access token Copy linkLink copied to clipboard!
This OCI referrers OAuth access token is used to list OCI referrers of a manifest under a repository.
Procedure
Update your
config.yaml
file to include theFEATURE_REFERRERS_API: true
field. For example:# ... FEATURE_REFERRERS_API: true # ...
# ... FEATURE_REFERRERS_API: true # ...
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Enter the following command to Base64 encode your credentials:
echo -n '<username>:<password>' | base64
$ echo -n '<username>:<password>' | base64
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
abcdeWFkbWluOjE5ODlraWROZXQxIQ==
abcdeWFkbWluOjE5ODlraWROZXQxIQ==
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Enter the following command to use the base64 encoded string and modify the URL endpoint to your Red Hat Quay server:
curl --location '<quay-server.example.com>/v2/auth?service=<quay-server.example.com>&scope=repository:quay/listocireferrs:pull,push' --header 'Authorization: Basic <base64_username:password_encode_token>' -k | jq
$ curl --location '<quay-server.example.com>/v2/auth?service=<quay-server.example.com>&scope=repository:quay/listocireferrs:pull,push' --header 'Authorization: Basic <base64_username:password_encode_token>' -k | jq
Copy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
{ "token": "<example_secret> }
{ "token": "<example_secret> }
Copy to Clipboard Copied! Toggle word wrap Toggle overflow