podman login successful for invalid registries

[gshepherd7]

Noticed this as a result of a typo, but it appears that when doing a podman login, as long as a curl GET returns success, that podman will report successful login regardless of the credentials entered. My example...

curl https://test2.di2e.net/v2/

302 Found

sudo podman login https://test2.di2e.net/v2/

Username: asdfadf
Password:
Login Succeeded!

A registry by this name does not exist, however the curl command is reporting found and upon validating the credentials it reports 'Login Succeeded!' even though the registry does not exist and doesn't matter what is entered for user/pass.

Is there something I am missing here with using podman login?

[mheon]

@vrothberg @mtrmac PTAL

[gshepherd7]

Understood. This caused panic on our end from a copy & paste of the incorrect registry name when attempting to pull images, after the successful login response. They thought their images were gone. Wasn't sure if there was a way to handle this. Is there a way I can check if the server does not require credentials prior to making the podman login request?

[mtrmac]

Parse the WWW-Authenticate header on the /v2/ response.

Let’s see what other think about making “verify credentials” operation used for login to do that automatically.

[vrothberg]

I am reluctant to change the current behavior as we'd likely break production users as @mtrmac has mentioned earlier.

We could, however, add a --verify flag to make sure the credentials were passed to the registry?

[mtrmac]

For podman login, I am fairly confident that failing with an error for “you don’t need to log in to this registry, double-check that what you are doing” is appropriate — it’s 100% appropriate for interactive use, and probably for non-interactive use as well.

For a plain podman pull, if there are credentials in auth.json, I’m fairly strongly leaning towards not failing.

For docker.CheckAuth, I don’t know — but we can introduce a new function easily enough, bypassing that question.

[vrothberg]

For podman login, I am fairly confident that failing with an error for “you don’t need to log in to this registry, double-check that what you are doing” is appropriate — it’s 100% appropriate for interactive use, and probably for non-interactive use as well.

That sounds attractive. I trust your judgement.

For a plain podman pull, if there are credentials in auth.json, I’m fairly strongly leaning towards not failing.

Totally agree on that.