zot
zot copied to clipboard
Username unknown in case of certificates authentication
Describe the bug
In the case of certificates auth we don't know the username of the client who authenticates with certificates, so we can not correctly use authorization in this case, maybe we should somehow obtain the username from certs?
Additional context
We discovered this while investigating how to use anonymous access per repo, and for certs auth we don't know the username, so we don't know on which policy the user falls to? anonymousAcess or defaultPolicy.
Let's say we have this config, someone authenticate with certs, with the current logic, anonymousAccess policy will be used(because we don't know the username, we don't know if he's authenticated), although defaultPolicy should be use, because he is authenticated.
"tmp/**": {
"anonymousAccess": ["read","create"],
"defaultPolicy": [
"read",
"create",
"update",
"delete"
]
},
Would use the SubjectName
for this.