WO2018077169A1 - 镜像仓库授权、访问、管理方法、服务器和客户端 - Google Patents

镜像仓库授权、访问、管理方法、服务器和客户端 Download PDF

Info

Publication number
WO2018077169A1
WO2018077169A1 PCT/CN2017/107525 CN2017107525W WO2018077169A1 WO 2018077169 A1 WO2018077169 A1 WO 2018077169A1 CN 2017107525 W CN2017107525 W CN 2017107525W WO 2018077169 A1 WO2018077169 A1 WO 2018077169A1
Authority
WO
WIPO (PCT)
Prior art keywords
authorization
user
authentication
mirror
warehouse
Prior art date
Application number
PCT/CN2017/107525
Other languages
English (en)
French (fr)
Inventor
谭珊珊
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2018077169A1 publication Critical patent/WO2018077169A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]

Definitions

  • the present disclosure relates to the field of communications, for example, to a mirrored warehouse authorization, access, management method, server, and client.
  • Docker is an open source engine that makes it easy to create a lightweight, portable, self-contained container for multiple applications. Docker provides a public repository called Docker Hub for storing Docker images, and the image resources uploaded to the public repository are for public use. Therefore, public warehouses are not suitable for a variety of application scenarios such as enterprise projects that are not fully open to the outside world. Therefore, the creation and management of private mirrored warehouses is particularly important.
  • private image repositories such as the Docker Registry.
  • a private image repository will involve users of different user roles accessing the image resources stored in the private image repository, such as administrators or R&D personnel or basic support personnel. At present, whether it is a private mirror warehouse or a public mirror warehouse, there is a lack of effective management methods for different users according to different user roles, resulting in the lack of rationality of the management of the mirror warehouse, and there are certain security risks.
  • the image warehouse authorization, access, management method, server and client provided by the disclosure can solve the problem that the mirror warehouse in the related art does not effectively control the access rights of different users according to different user roles.
  • a mirrored warehouse authorization method applied to a mirrored warehouse authorization server including:
  • the authorization token is fed back to the mirrored warehouse client.
  • a mirrored warehouse access method applied to a mirrored warehouse client including:
  • Receiving the authorization token that is sent by the mirrored warehouse authorization server after the user is successfully authenticated according to the identity information and the preset correspondence table, and the content of the correspondence relationship table is a correspondence between the identity information and the user role. ;as well as
  • a mirror resource access request is sent to the mirror repository server based on the authorization token.
  • a mirrored warehouse management method applied to a mirrored warehouse server including:
  • the image resource access request is determined to be an unauthorized request, sending an authorization authentication indication notification to the mirrored warehouse client, where the authorization authentication indication notification includes the mirror warehouse authorization server address information;
  • the image resource access request is determined to be an authorized request
  • the image resource access request is accessed according to the authorization token corresponding to the image resource access request.
  • a mirrored warehouse authorization server including:
  • the authentication receiving module is configured to receive an authentication request sent by the mirror warehouse client for accessing the mirror warehouse, where the authentication request includes at least the identity information of the user;
  • the authorization authentication module is configured to perform authorization authentication on the user according to the identity information and a preset correspondence relationship table, where the content of the correspondence relationship table is a correspondence between the identity information and the user role. Different user roles correspond to different access rights;
  • the authentication feedback module is configured to feed back an authorization token to the mirrored warehouse client when the authorization authentication succeeds.
  • a mirrored warehouse client that includes:
  • An authentication processing module configured to send an authentication request to the mirrored warehouse authorization server, where the authentication request includes at least the identity information of the user, and the receiving the mirrored warehouse authorization server according to the identity information and the preset correspondence table to the user After the authorization is successfully authenticated, the authorized authorization token, the content of the correspondence table is the correspondence between the identity information and the user role;
  • the resource access module is configured to send a mirror resource access request to the mirror repository server based on the authorization token.
  • a mirrored warehouse server that includes:
  • Accessing the receiving module configured to receive a mirror resource access request sent by the mirrored warehouse client
  • control module configured to: when the image resource access request is determined to be an unauthorized request, send an authorization authentication indication notification to the mirrored warehouse client, where the authorization authentication indication notification includes image warehouse authorization server address information; and is configured to determine the image
  • the mirror resource access request is accessed according to the authorization token corresponding to the image resource access request.
  • a computer storage medium storing computer executable instructions for performing the aforementioned image warehouse authorization, access, and management methods.
  • a mirrored warehouse authorization server including one or more processors, memory, and one or more programs, the one or more programs being stored in memory when executed by one or more processors Execute any of the above mirrored warehouse authorization methods.
  • a mirrored warehouse client that includes one or more processors, memory And one or more programs, the one or more programs being stored in the memory, and when executed by the one or more processors, performing any of the mirrored warehouse access methods described above.
  • a mirrored warehouse server comprising one or more processors, memory, and one or more programs, the one or more programs being stored in a memory, executed when executed by one or more processors Any of the above mirrored warehouse management methods.
  • a computer program product comprising a computer program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions that, when executed by a computer, cause the computer to execute Any of the above methods.
  • the image warehouse authorization, access, management method, server, client and computer storage medium provided by the disclosure effectively control the access rights of different users accessing the mirror warehouse according to different user roles, and can provide fine-grained mirror warehouses. Access control improves the usability, security, and management of the mirrored warehouse.
  • FIG. 1 is a schematic flowchart of a method for accessing a mirrored warehouse in the first embodiment
  • Embodiment 2 is a schematic flowchart of an authorization certification indication process in Embodiment 1;
  • FIG. 3 is a schematic flowchart of a method for authorizing a mirrored warehouse in the first embodiment
  • FIG. 4 is a schematic flowchart of a mirrored warehouse management method in Embodiment 1;
  • FIG. 5 is a schematic structural diagram of a mirrored warehouse client in the second embodiment
  • FIG. 6 is a schematic structural diagram of a mirrored warehouse authorization server in Embodiment 2;
  • FIG. 7 is a schematic structural diagram of a mirrored warehouse server in Embodiment 2.
  • 8-1 is a schematic diagram of an identity authentication method in Embodiment 3.
  • FIG. 8-2 is a schematic diagram of an authorization authentication method in Embodiment 3.
  • Embodiment 9 is a schematic diagram of an authorization authentication process in Embodiment 3.
  • Embodiment 10 is a schematic diagram of configuration information in Embodiment 3.
  • FIG. 11 is a schematic diagram showing the hardware structure of a mirrored warehouse authorization server in the fourth embodiment.
  • FIG. 12 is a schematic diagram showing the hardware structure of a mirrored warehouse client in the fourth embodiment
  • FIG. 13 is a schematic diagram showing the hardware structure of a mirrored warehouse server in the fourth embodiment.
  • the mirrored warehouse client in this embodiment sends an authentication request to the mirrored warehouse authorization server, and the mirrored warehouse authorization server authenticates the user according to the identity information in the authentication request and the preset identity information and the user role correspondence table, wherein different user roles are used.
  • the authorization token is fed back to the mirror warehouse client; the mirror warehouse client sends a mirror resource access request to the mirror warehouse server based on the authorization token, and the mirror warehouse server determines the mirror When the resource access request is an authorized request, the mirror resource access request is accessed according to the authorization token corresponding to the mirror resource access request.
  • the mirrored warehouse access method provided in this embodiment implements effective control of access rights of different users accessing the mirrored warehouse according to different user roles, and can provide fine-grained access control to the mirrored warehouse, thereby improving the practicability and security of the mirrored warehouse. Sexuality and management rationality.
  • the embodiment separately illustrates the three ends of the mirror warehouse client, the mirror warehouse server, and the mirror warehouse authorization server.
  • the mirror warehouse client can send a mirror resource access request to the mirror warehouse server according to the command request sent by the user, and according to the mirror warehouse service fed back by the mirror warehouse server to the mirror warehouse
  • the library authorization server sends an authentication request.
  • the authentication request can be sent to the mirrored warehouse authorization server according to the command sent by the user.
  • the implementation can be flexibly selected according to the application scenario.
  • a method for accessing a mirrored warehouse provided in this embodiment is shown in FIG. 1 and includes the following steps.
  • the mirrored warehouse client sends an authentication request to the mirrored warehouse authorization server, where the authentication request includes at least the identity information of the user.
  • the authentication request in this embodiment may be sent by the mirrored warehouse client according to the indication of the mirrored warehouse server, or may be directly sent by the mirrored warehouse client according to the user's instruction.
  • the mirrored warehouse client receives the authorization token that is returned by the mirrored warehouse authorization server according to the identity information in the authentication request and the correspondence between the preset identity information and the user role.
  • the identity information and the user role correspondence table may be pre-configured locally in the mirrored warehouse authorization server, or may be configured in a database accessible by other mirrored warehouse authorization servers.
  • different user roles correspond to different access rights.
  • the user roles and corresponding access rights settings can be flexibly set according to actual application scenarios.
  • step 130 the mirrored warehouse client sends a mirrored resource access request to the mirrored warehouse server based on the authorization token.
  • the manner in which the mirrored warehouse client sends the authentication request, the mirror resource access request, and the adopted protocol can be flexibly set according to actual needs.
  • the mirrored warehouse in this embodiment may include a Docker image repository.
  • the following steps shown in FIG. 2 may also be included.
  • step 210 the mirrored warehouse client sends a mirrored resource access request to the mirrored warehouse server.
  • the mirrored warehouse server After receiving the image resource access request, the mirrored warehouse server first determines whether the image resource access request has been authenticated. If yes, the subsequent access step is performed. If not, the image warehouse is prompted. The client performs authorization authentication.
  • step 220 when the mirrored warehouse client receives the authorization authentication indication notification returned by the mirrored warehouse server, the mirrored warehouse authorization server sends the authentication request to the mirrored warehouse authorization server according to the mirrored warehouse authorization server address information in the authorization authentication indication notification.
  • the mirrored warehouse authorization server address information in this embodiment may be configured in advance on the mirrored warehouse server.
  • the authentication request sent by the mirrored warehouse client to the mirrored warehouse authorization server may contain different information.
  • the following two examples are described.
  • the authentication request sent by the mirrored warehouse client can contain only the user's identity information to complete the authorization authentication.
  • the authorization authentication can be authenticated only according to whether the identity information is legal.
  • the issued authorization token can be included.
  • the user corresponds to all access rights of the user role (the access rights include the range of mirror resources allowed by the user role and the range of allowed operation types).
  • the authentication request may also include the user password, and the mirrored warehouse authorization server may Before the authentication request authenticates the user, the user may first identify the identity based on the identity information, the user password, and the preset identity information and the user password.
  • the authentication request sent by the mirrored warehouse client may include the identity information of the user, the currently accessed image resource information (which may be the currently accessed image resource address, or the type and name of the currently accessed mirror resource) and the current The operation type of the access request; the authorization authentication at this time can be based on whether the identity information is legal, and whether the currently accessed image resource information is within the scope of the mirrored resource allowed by the user role of the user (may be a mirrored resource address range, or The type and name of the mirrored resource), and whether the operation type of the current access request is within the scope of the type of operation allowed by the user role of the user.
  • the authentication request may also include a user password.
  • the configuration file may be configured according to the identity information, the user password, and the preset identity information and the user password. , authenticate the user.
  • the authorized token package is delivered.
  • the mirroring resource that is allowed to be accessed by the user which may be the mirroring resource that is allowed to be accessed by the user role of the user in the foregoing example 2, may be the mirroring resource that is allowed to be accessed by the user role of the user in the above example 1,
  • the operation type (may be all allowed operation types corresponding to the user role of the user in the above example one, and may also be the operation type currently allowed by the user role of the user in the above example 2), and may also include the token valid time.
  • the setting of the validity time of the token can be flexibly set according to actual needs, for example, set to 10 minutes, 30 minutes, and the like.
  • the mirrored warehouse client can send a mirrored resource access request to the mirrored warehouse server based on the authorization token in any of the following ways.
  • Manner 1 The obtained authorization token is sent to the mirror warehouse server separately, and then the corresponding mirror resource access request is sent to the mirror warehouse server.
  • Manner 2 The authorization token that contains the mirror resource, the operation type, and the validity time of the token is allowed to be added to the mirror resource access request, and then sent to the mirror repository server.
  • FIG. 3 the process of the image warehouse authorization method performed by the image repository authorization server side is shown in FIG. 3, and includes the following steps.
  • step 310 an authentication request sent by the mirror repository client for accessing the mirror repository is received, and the authentication request includes at least the identity information of the user (including the username).
  • step 320 the user is authorized to authenticate according to the identity information in the authentication request and the correspondence between the preset identity information and the user role, and different user roles correspond to different access rights.
  • step 330 when the authorization authentication succeeds, the authorization token is fed back to the mirror warehouse client, so that the mirror warehouse client accesses the mirror warehouse based on the authorization token.
  • the authentication request sent by the mirrored warehouse client in this embodiment may further include a user password; the mirrored warehouse authorization server may also perform identity authentication according to the identity information before authenticating the user in the authentication request. And the user password, combined with the configuration file of the pre-set identity information and the user password, authenticates the user, and performs the subsequent authorization authentication process after the identity authentication is passed. If the identity authentication fails, the subsequent authorization authentication is not performed. Process, And the authentication failure is reported to the mirrored warehouse client.
  • the authorization authentication manner in this embodiment may include the following two exemplary manners.
  • Example 1 The authentication request sent by the mirrored warehouse client can only contain the identity information of the user.
  • the mirrored warehouse server authorization authentication may be based on the identity information, and the user is authorized to authenticate according to the preset identity information and the user role correspondence table, for example, whether the identity information exists in the identity information and the user role correspondence table. If the authentication succeeds, after the authorization is successfully authenticated, the authorization token sent to the mirrored warehouse client can include all access rights of the user role of the user.
  • the access rights include the range of mirror resources allowed by the user role and allowed. Type of operation).
  • the authentication request sent by the mirrored warehouse client may include the identity information of the user, the currently accessed image resource information (which may be the currently accessed image resource address, or the type and name of the currently accessed mirror resource) and the current Accessing the requested operation type; at this time, the mirrored warehouse server authorization authentication can be based on whether the identity information is legal, and whether the currently accessed image resource information is within the scope of the mirrored resource allowed by the user role of the user (may be the mirror resource address range, It can be the type range and name of the mirror resource, and whether the operation type of the current access request is within the scope of the type of operation allowed by the user role of the user for authorization authentication.
  • the access rights in this embodiment include a range of mirror resources allowed to be accessed by the user role and a range of allowed operation types.
  • the operation type may include uploading, downloading, deleting, and querying.
  • the user role may also be set. Permissions for the corresponding access rights.
  • the scope of the mirrored resource can be defined by limiting the scope of the mirrored resource address (for example, which address in the mirrored warehouse), or by the type of the mirrored resource. And the name is limited, or combined with both.
  • the process of performing the authorization authentication by the mirrored warehouse authentication server at this time includes: searching for the preset identity information and the user role correspondence table according to the identity information in the authentication request.
  • the user role corresponding to the user is determined whether the currently accessed image resource information is within the scope of the image resource allowed to be accessed by the user role, and the operation type of the current access request is within the allowed operation type range. If not, the authorization authentication failed.
  • the process of performing the authorization authentication by the mirrored warehouse authentication server includes: finding the role second user role corresponding to the user name 4 in the table 1, determining that the current operation type is downloaded within the allowed operation type range, and the currently accessed mirror resource is allowed. Within the scope of the access, the authorization is successfully authenticated.
  • the identity information in the authentication request is the user name 7, and the current operation type is deleted.
  • the currently accessed image resource information is an image file whose resource type is the repository name test/my-app.
  • the process of performing the authorization authentication by the mirrored warehouse authentication server includes: finding the fourth user role of the role corresponding to the user name 7 in Table 1, and determining that the current operation type deletion is not within the allowed operation type range. Authorization authentication failed.
  • the identity information in the authentication request is the user name 10
  • the current operation type is the query
  • the currently accessed image resource information is an image file whose resource type is the repository name test/my-app.
  • the process of performing authorization authentication by the mirrored warehouse authentication server includes: the user name 10 is not found in Table 1, and the authorization authentication fails.
  • FIG. 4 the process of the image warehouse management method executed by the mirror warehouse server side is shown in FIG. 4, and includes the following steps.
  • step 410 a mirror resource access request sent by the mirror repository client is received.
  • step 420 it is determined whether the image resource access request is an authorization request. If the image resource access request is not an authorization request, go to step 430 for authorization authentication. If the image resource access request is an authorization request, go to step 440 for access. deal with.
  • the mirror warehouse server may further process the authorization token after processing the image resource access request.
  • the storage is performed, so that when the subsequent image resource access request that does not include the authorization token is received, whether the image resource access request is an authorization request may be determined according to the previously stored authorization token.
  • the authorization authentication indication notification is sent to the mirrored warehouse client, and the authorization authentication indication notification includes the mirrored warehouse authorization server address information.
  • the authorization authentication is performed in the foregoing example 2, the currently accessed image resource information and the operation type may also be included. Add this information when the image repository client generates an authentication request.
  • step 440 the image resource access request is accessed according to the authorization token corresponding to the image resource access request, for example, corresponding downloading, uploading, deleting, and querying are performed.
  • the manner of accessing the image resource access request according to the authorization token corresponding to the image resource access request in the embodiment also includes the following steps.
  • the interaction manners of multiple messages between the mirrored warehouse client, the mirrored warehouse server, and the mirrored warehouse authorization server can be flexibly set. This embodiment implements effective control of access rights of different users accessing the mirror warehouse according to different user roles, and can provide fine-grained access control to the mirror warehouse, thereby improving the practicability, security, and management rationality of the mirror warehouse.
  • This embodiment provides a mirrored warehouse client, as shown in FIG. 5, including the following modules.
  • the authentication processing module 51 is configured to send an authentication request to the mirror repository authorization server, where the authentication request includes at least the identity information of the user, and the receiving mirror warehouse authorization server performs a correspondence between the identity information and the preset identity information and the user role.
  • the authorization token that is fed back after the user authorization is successfully authenticated.
  • the authentication processing module 51 may send a mirror resource access request to the mirror warehouse server according to the command sent by the user, and send an authentication request to the mirror warehouse authorization server according to the mirror warehouse service fed back by the mirror warehouse server; or may learn the mirror warehouse authorization server. At the address, the authentication request is sent directly to the mirror repository authorization server according to the command sent by the user.
  • the identity information and the user role correspondence table may be pre-configured locally in the mirrored warehouse authorization server, or may be configured in a database accessible by other mirrored warehouse authorization servers.
  • different user roles correspond to different access rights.
  • the user roles and corresponding access rights settings can be flexibly set according to actual application scenarios.
  • the resource access module 52 is configured to send a mirror resource access request to the mirror repository server based on the authorization token.
  • the authentication request sent by the authentication processing module 51 to the mirror repository authorization server may contain different information, which is described below in two example cases.
  • the authentication request sent by the authentication processing module 51 may only include the identity information of the user. To complete the authorization authentication, the authorization authentication at this time can be authenticated only according to whether the identity information is legal.
  • the issued authorization token can include all access rights of the user role corresponding to the user role (the access rights include the image that the user role allows access to. The scope of the resource and the range of allowed types of operations).
  • the authentication request sent by the authentication processing module 51 may include the identity information of the user, the currently accessed mirror resource information (which may be the currently accessed mirror resource address, or the type and name of the currently accessed mirror resource) and the current The operation type of the access request; the authorization authentication at this time can be based on whether the identity information is legal, and whether the currently accessed image resource information is within the scope of the mirrored resource allowed by the user role of the user (may be a mirrored resource address range, or The type and name of the mirrored resource), and whether the operation type of the current access request is within the scope of the type of operation allowed by the user role of the user.
  • the authentication request may further include a user password.
  • the configuration file may be configured according to the identity information, the user password, and the preset identity information and the user password. , authenticate the user.
  • the issued authorization token includes a mirroring resource that is allowed to be accessed by the user (may be all allowed access mirrors corresponding to the user role of the user in the above example one).
  • the resource may also be the image resource that the user role of the user is currently allowed to access in the example 2 above, and the operation type (may be all allowed operation types corresponding to the user role of the user in the above example one, or may be the above
  • the type of operation currently permitted by the user role of the user in the second example may further include a token validity time, and the setting of the validity time of the token may be flexibly set according to actual needs, for example, set to 20 minutes, 30 minutes, and the like.
  • the resource access module 52 may send the mirror resource access request to the mirror warehouse server based on the authorization token in any of the following manners.
  • the resource access module 52 separately sends the obtained authorization token to the mirror warehouse server, and then sends a corresponding mirror resource access request to the mirror warehouse server.
  • the resource access module 52 adds the authorization token including the mirror resource, the operation type, and the token validity time to the mirror resource access request, and then sends it to the mirror repository server.
  • This embodiment also provides a mirrored warehouse authorization server. As shown in FIG. 6, the following modules are included.
  • the authentication receiving module 61 is configured to receive an authentication request sent by the mirror warehouse client for accessing the mirror warehouse, where the authentication request includes at least user identity information (including a username).
  • the authorization authentication module 62 is configured to perform authorization authentication on the user according to the identity information and the correspondence relationship between the preset identity information and the user role, and different user roles correspond to different access rights.
  • the authentication feedback module 63 is configured to: when the authorization authentication succeeds, feed back an authorization token to the mirror warehouse client, so that the mirror warehouse client accesses the mirror warehouse based on the authorization token.
  • the authentication request sent by the mirrored warehouse client in this embodiment may further include a user password.
  • the mirrored warehouse authorization server further includes an identity authentication module 64, which is set as a user in the authentication request.
  • the user may first perform the identity authentication according to the identity information and the user password, and the configuration file corresponding to the user identity and the user password. After the identity authentication is passed, the authorization authentication module performs the subsequent authorization authentication process. If the identity authentication fails, the subsequent authorization authentication process is not performed, and the authentication failure is fed back to the mirrored warehouse client.
  • the authorization authentication manner in this embodiment may include the following two exemplary manners.
  • Example 1 The authentication request sent by the mirrored warehouse client can only contain the identity information of the user.
  • the authorization authentication module 62 authorizes the authentication to authenticate the user based on the identity information and the preset relationship information and the user role correspondence table, for example, whether the identity information exists in the correspondence table between the identity information and the user role. If the authentication succeeds, after the authorization is successfully authenticated, the authorization token sent to the mirrored warehouse client can include all access rights of the user role corresponding to the user (the access rights include the range of mirror resources allowed by the user role and The range of allowed operation types).
  • the authentication request sent by the mirrored warehouse client may include the identity information of the user, and the currently accessed mirror resource information (which may be the currently accessed mirror resource address or the current access).
  • the scope (which can be the range of the mirror resource address, or the type range and name of the mirrored resource), and whether the operation type of the current access request is within the scope of the type of operation allowed by the user role of the user for authorization authentication.
  • the access rights in this embodiment include the range of mirror resources allowed to be accessed by the user role and the range of allowed operation types.
  • the operation types include but are not limited to uploading, downloading, deleting, and querying.
  • the user may also have a setting user.
  • This embodiment also provides a mirrored warehouse server, as shown in FIG. 7, including the following modules.
  • the access receiving module 71 is configured to receive a mirror resource access request sent by the mirror warehouse client.
  • the control module 72 is configured to: when the image resource access request is determined to be an unauthorized request, send an authorization authentication indication notification to the mirrored warehouse client, where the authorization authentication indication notification includes the mirrored warehouse authorization server address information, and when the authorization authentication is performed by using the foregoing example 2,
  • the image resource information and the operation type of the current access may also be included for the mirrored warehouse client to add the information when the authentication request is generated;
  • the control module 72 is further configured to determine that the mirror resource access request is an authorized request, according to the mirror resource access.
  • the corresponding authorization token is requested to perform access processing on the mirror resource access request.
  • the control module 72 may further store the authorization token after processing the mirror resource access request, so that the subsequent token is not included.
  • the image resource access request of the authorization token may be determined as an authorization request according to the previously stored authorization token.
  • the control module 72 is configured to determine whether the authorization token is currently valid according to the validity time of the authorization token, and if not, send a re-authorization authentication indication notification to the mirrored warehouse client; if valid, determine the mirror resource access. Requesting whether the currently accessed image resource information is within the scope of the allowed mirroring resource, and whether the operation type of the current access request is within the allowed operation type range, and if so, performing access; if not, denying access or to the mirroring The warehouse client sends a reauthorization certification indication notification.
  • the functions of the above plurality of modules in this embodiment may be implemented by circuits or codes within the microcontroller. That is, the modules or steps of the present embodiment may be implemented by a general-purpose computing device, which may be centralized on a single computing device or distributed over a network of multiple computing devices. Alternatively, they may be used in computing devices. Executable program code is implemented so that they can be stored in a computer storage medium (ROM/RAM, disk, optical disk) by a computing device and, in some cases, can be executed in a different order than here.
  • the steps shown or described are either fabricated into a plurality of integrated circuit modules, or a plurality of modules or steps are fabricated as a single integrated circuit module.
  • the mirrored warehouse is a Docker image warehouse, and the technical solution of the present disclosure is described in combination with the foregoing example 2.
  • the function of the identity authentication module is to receive the Docker authentication request and perform identity authentication by using the specified authentication method.
  • the authentication request in this embodiment may use a Hyper Text Transfer Protocol over Secure Socket Layer (HTTPS) for secure Hyper Text Transfer Protocol (HTTP) data transmission.
  • HTTPS Hyper Text Transfer Protocol over Secure Socket Layer
  • the identity authentication module can support multiple authentication methods, for example, the following steps can be included.
  • step 811 the username and the encrypted password are placed in the configuration file.
  • the static file configuration method is to put the user name and the encrypted password in the configuration file, and the configuration file is loaded when the authorization device is running.
  • the configuration file is configured with the current user name and password, wherein the password uses a cross-platform file encryption tool. (Blowfish File Encryption, B-crypt) encryption, which is simple to implement.
  • step 812 the data is stored in a tree hierarchy, and a running LDAP service is started.
  • Container and configure the address and other information of the LDAP server through the configuration file.
  • the Lightweight Directory Access Protocol which stores data in a tree-like hierarchy, needs to start a container running the LDAP server. Then, the authorization device configures the address of the LDAP server through the configuration file. And other information.
  • LDAP Lightweight Directory Access Protocol
  • step 813 a configuration file that loads information such as an address port of the configuration database is authenticated by reading user data stored in the database.
  • a plurality of databases when the authorization device is started, load a configuration file of information such as an address port of the configuration database, and each operation of the mirror warehouse performs authentication by reading user data stored in the database.
  • the function of the authorization authentication module in this embodiment is to issue an authorization token token according to the user information in the authentication request and the requested authorization scope (including the accessed resource type, name, and specific operation type).
  • the token is generated by a JWT (JSON Web Token) authentication scheme.
  • the token contains the token type (ie JWT), the signature algorithm used by the token, the issuer of the token, and the validity period of the token.
  • the authorization authentication method includes the following steps.
  • step 821 the username and the range of permissions that the username has are placed in the configuration file.
  • the Access Control List (ACL) authorization method can be used in conjunction with the above static file configuration.
  • the configuration file In the configuration file, the user name and the permission range of the user name are described.
  • step 822 the address and other information of the LDAP server are configured through the configuration file mode.
  • LDAP authorization can be used in conjunction with LDAP authentication.
  • step 823 a configuration file that loads information such as an address port of the configuration database is authorized by reading user data stored in the database.
  • the database authorization method can be used together with the above database authentication.
  • the database storage data is authorized to have a richer usage scenario, and the user can select the database according to the needs. Types of.
  • Figure 9 shows the completion process of the authorization certificate, including the following steps.
  • step 910 the mirrored warehouse client initiates a resource access request to the mirrored warehouse server.
  • step 920 the mirrored warehouse server returns the authorized address and the authorization range generated from the requested address.
  • the mirrored warehouse client carries the username and password to send an authentication request to the mirrored warehouse authorization server.
  • step 940 the mirror repository authorization server first authenticates the user information and the request scope. After the authentication is passed, the authorization token token is sent to the mirror warehouse client.
  • step 950 the mirrored warehouse client carries the token to initiate a resource access request to the mirrored warehouse server again.
  • step 960 the mirror repository server responds to the request resource after receiving the resource access request.
  • the general Docker image repository authorization server is used to authenticate and authorize the Docker image repository server as follows.
  • the configuration of the mirrored warehouse authorization server information is loaded, including the mirrored warehouse authorization server address.
  • the name of the mirrored warehouse can also be called the service name.
  • the mirrored warehouse authorization server name is the issue of the token. Party, and the absolute path of the public key (used with HTTPS).
  • the mirrored warehouse authorization server is also started, and the configuration information including the token is loaded.
  • the name of the authorized device must be the same as the configuration of the Docker image repository server above, and the validity period of the token must be configured.
  • the Docker image repository client receives a command request from the user. For example, in the case of the Docker Registry image repository, the image repository client logs in to the Docker Registry with a username and password. For example, there is currently a user test, using the command docker login 10.11.21.22:5000, 10.11.21.22:5000 The address of the Docker Registry,
  • the docker pull 10.11.21.22:5000:test/my-app command is executed to download the image from the mirror repository server to the local Docker.
  • the Docker image repository server returns an HTTP response with a status code of 401 because the resource access request is not authorized by the authorized server.
  • the response header contains the address of the authorized device, the service name.
  • the server name can be set to DIS. -Registry, at the same time, also contains the scope of the operation.
  • the realm is the address of the authorization server, the service is the service name, the scope describes the requested resource type, the resource name and the operation scope, and the current resource type is the repository.
  • the developer can expand the resource type and the requested resource name as needed.
  • the name of the image to be downloaded in this embodiment is test/my-app.
  • the action to be performed is to download, that is, pull.
  • the operation can be of three types: * (for all permissions with mirroring operations), push, pull (for mirrored upload and download permissions), and pull (for mirrored download permissions).
  • * for all permissions with mirroring operations
  • push for mirrored upload and download permissions
  • pull for mirrored download permissions
  • the mirrored warehouse client sends an authentication request to the mirrored warehouse authorization server according to the above authorization information.
  • the name and password are authenticated.
  • the authentication method uses the PostgreSQL database.
  • the device compares the requested username and password with the username and password stored in the database. At the same time, for the resource type, name and operation described in the scope, the query of the database content is compared. If the agreement is not consistent, the authentication will not pass, and the response message with the status code of 401 is returned. And the reason why the certification failed.
  • the mirrored warehouse authorization server returns a token according to the scope required above, indicating that access rights are obtained.
  • the response message body is returned via HTTP, including the generated token.
  • the mirrored repository client resends the resource access request and sends it to the Docker image repository server.
  • the Authorization header field is added to the sent header, that is, the Bearer and a space are added before the token value.
  • the Docker image repository server receives the resource access request with the token and performs the required operations of the mirrored repository client requesting the resource, ie downloading the image to the local Docker.
  • the same request for the mirrored warehouse client can be directly executed during the validity period of the token, and the re-authentication is required to improve the efficiency of the operation while ensuring security.
  • the mirrored warehouse authorization server can be quickly and easily integrated with the Docker image repository.
  • the Docker image repository achieves fine-grained access control through the above-mentioned series of authentication and authorization steps.
  • the general Docker authorization method and device realizes the access control of the Docker image warehouse operation, and is conveniently deployed to the Docker through the mirroring method, thereby improving the efficiency of the Docker image warehouse development.
  • the embodiment provides a computer readable storage medium storing computer executable instructions for performing the above method.
  • the mirrored warehouse authorization server includes: a processor 111 and a memory 112; A communication interface 113 and a bus 114 may be included.
  • the processor 111, the memory 112, and the communication interface 113 can complete communication with each other through the bus 114.
  • the communication interface 113 can be used for information transmission.
  • the processor 111 can call the memory 112 Logic instructions in the execution of any of the mirrored warehousing methods of the above embodiments.
  • the mirrored warehouse client includes: a processor 121 and a memory 122; and may further include a communication interface 123 and a bus. 124.
  • the processor 121, the memory 122, and the communication interface 123 can complete communication with each other through the bus 124.
  • the communication interface 123 can be used for information transmission.
  • the processor 121 can call the logic instructions in the memory 122 to perform any of the mirrored warehouse access methods of the above embodiments.
  • the mirrored warehouse server includes: a processor 131 and a memory 132 ; and may further include a communication interface 133 and a bus 134 . .
  • the processor 131, the memory 132, and the communication interface 133 can complete communication with each other through the bus 132.
  • the communication interface 133 can be used for information transmission.
  • the processor 131 can call the logic instructions in the memory 132 to perform any of the mirrored warehouse management methods of the above embodiments.
  • the above memory may include a storage program area and a storage data area, and the storage program area may store an operating system and an application required for at least one function.
  • the storage data area can store data and the like created according to the use of the electronic device.
  • the memory may include, for example, a volatile memory of a random access memory, and may also include a non-volatile memory. For example, at least one disk storage device, flash memory device, or other non-transitory solid state storage device.
  • the logic instructions in the above-described memories can be implemented in the form of software functional units and sold or used as separate products
  • the logic instructions can be stored in a computer readable storage medium.
  • the technical solution of the present disclosure may be embodied in the form of a computer software product, which may be stored in a storage medium, and includes a plurality of instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) Perform all or all of the methods described in this embodiment Part of the steps.
  • the storage medium may be a non-transitory storage medium or a transitory storage medium.
  • the non-transitory storage medium may include: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, and the like, which can store program codes. medium.
  • All or part of the process of implementing the foregoing embodiment may be performed by a computer program to indicate related hardware, and the program may be stored in a non-transitory computer readable storage medium, and when the program is executed, may include The flow of an embodiment of the above method.
  • the image warehouse authorization, access, management method, server and client provided by the disclosure can effectively control the access rights of different users accessing the mirror warehouse according to different user roles, and can provide fine-grained access control to the mirror warehouse and improve the access control.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Multimedia (AREA)
  • Storage Device Security (AREA)
  • Information Transfer Between Computers (AREA)

Abstract

一种镜像仓库授权、访问、管理方法及服务器、镜像仓库客户端，镜像仓库客户端向镜像仓库授权服务器发送认证请求，镜像仓库授权服务器根据认证请求中的身份信息和预设的身份信息与用户角色对应关系表对用户进行授权认证，其中不同用户角色对应不同的访问权限；并在所述用户授权认证成功后，反馈的授权令牌；镜像仓库客户端基于该授权令牌向镜像仓库服务器发送镜像资源访问请求，镜像仓库服务器判定该镜像资源访问请求为已授权请求时，根据镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理。

Description

镜像仓库授权、访问、管理方法、服务器和客户端 技术领域
本公开涉及通信领域，例如涉及一种镜像仓库授权、访问、管理方法、服务器和客户端。
背景技术
Docker是一个开源的引擎，可以轻松的为多种应用创建一个轻量级的、可移植的、自给自足的容器。Docker提供了一个公有仓库，称为Docker Hub，用于存储Docker镜像，上传到公用仓库的镜像资源都是用于公开免费使用。因此公有仓库不适用于企业项目等不完全对外开放的多种应用场景。因此私有镜像仓库的创建和管理使用就显得尤为重要。当前有很多私有镜像仓库的实现方式，比如Docker Registry。但是即使是私有镜像仓库，仍会涉及到不同用户角色的用户对该私有镜像仓库中存储的镜像资源进行访问，例如管理员或者研发人员或者是基础支持人员等等。而目前不管是私有镜像仓库还是公有镜像仓库，都缺少根据不同用户角色对不同用户的访问权限进行有效的管理方式，导致镜像仓库的管理缺少合理性，又存在一定的安全隐患。
发明内容
本公开提供的一种镜像仓库授权、访问、管理方法、服务器和客户端，可以解决相关技术中镜像仓库没有根据不同用户角色对不同用户的访问权限进行有效控制的问题。
一种镜像仓库授权方法，应用于镜像仓库授权服务器，包括：
接收镜像仓库客户端发送的用于访问镜像仓库的认证请求，所述认证请求至少包含用户的身份信息；
根据所述身份信息和预设的对应关系表，对所述用户进行授权认证，所述对应关系表的内容为身份信息与用户角色的对应关系，不同用户角色对应不同的访问权限；以及
授权认证成功时，向所述镜像仓库客户端反馈授权令牌。
一种镜像仓库访问方法，应用于镜像仓库客户端，包括：
向镜像仓库授权服务器发送认证请求，所述认证请求中至少包含用户的身份信息；
接收所述镜像仓库授权服务器根据所述身份信息和预设的对应关系表对所述用户授权认证成功后，反馈的授权令牌，所述对应关系表的内容为身份信息与用户角色的对应关系；以及
基于所述授权令牌向镜像仓库服务器发送镜像资源访问请求。
一种镜像仓库管理方法，应用于镜像仓库服务器，包括：
接收镜像仓库客户端发送的镜像资源访问请求；
判定该镜像资源访问请求为未授权请求时，向所述镜像仓库客户端发送授权认证指示通知，所述授权认证指示通知包含镜像仓库授权服务器地址信息；以及
判定该镜像资源访问请求为已授权请求时，根据该镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理。
一种镜像仓库授权服务器，包括：
认证接收模块，设置为接收镜像仓库客户端发送的用于访问镜像仓库的认证请求，所述认证请求至少包含用户的身份信息；
授权认证模块，设置为根据所述身份信息和预设的对应关系表，对所述用户进行授权认证，所述对应关系表的内容为身份信息与用户角色的对应关系， 不同用户角色对应不同的访问权限；以及
认证反馈模块，设置为在授权认证成功时，向所述镜像仓库客户端反馈授权令牌。
一种镜像仓库客户端，包括：
认证处理模块，设置为向镜像仓库授权服务器发送认证请求，所述认证请求至少包含用户的身份信息，以及接收所述镜像仓库授权服务器根据所述身份信息和预设的对应关系表对所述用户授权认证成功后，反馈的授权令牌，所述对应关系表的内容为身份信息与用户角色的对应关系；以及
资源访问模块，设置为基于所述授权令牌向镜像仓库服务器发送镜像资源访问请求。
一种镜像仓库服务器，包括：
访问接收模块，设置为接收镜像仓库客户端发送的镜像资源访问请求；以及
控制模块，设置为判定该镜像资源访问请求为未授权请求时，向所述镜像仓库客户端发送授权认证指示通知，所述授权认证指示通知包含镜像仓库授权服务器地址信息；以及设置为判定该镜像资源访问请求为已授权请求时，根据该镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理。
一种计算机存储介质，所述计算机存储介质中存储有计算机可执行指令，所述计算机可执行指令用于执行前述的镜像仓库授权、访问、管理方法。
一种镜像仓库授权服务器，该镜像仓库授权服务器包括一个或多个处理器、存储器以及一个或多个程序，所述一个或多个程序存储在存储器中，当被一个或多个处理器执行时，执行上述任意一种镜像仓库授权方法。
一种镜像仓库客户端，该镜像仓库客户端包括一个或多个处理器、存储器 以及一个或多个程序，所述一个或多个程序存储在存储器中，当被一个或多个处理器执行时，执行上述任意一种镜像仓库访问方法。
一种镜像仓库服务器，该镜像仓库服务器包括一个或多个处理器、存储器以及一个或多个程序，所述一个或多个程序存储在存储器中，当被一个或多个处理器执行时，执行上述任意一种镜像仓库管理方法。
一种计算机程序产品，所述计算机程序产品包括存储在非暂态计算机可读存储介质上的计算机程序，所述计算机程序包括程序指令，当所述程序指令被计算机执行时，使所述计算机执行上述任意一种方法。
本公开提供的镜像仓库授权、访问、管理方法、服务器、客户端及计算机存储介质，实现了根据不同用户角色对访问镜像仓库的不同用户的访问权限进行有效控制，能够给镜像仓库提供细粒度的访问控制，提升了镜像仓库的实用性、安全性以及管理的合理性。
附图说明
图1为实施例一中的镜像仓库访问方法流程示意图；
图2为实施例一中的授权认证指示流程示意图；
图3为实施例一中的镜像仓库授权方法流程示意图；
图4为实施例一中的镜像仓库管理方法流程示意图；
图5为实施例二中的镜像仓库客户端结构示意图；
图6为实施例二中的镜像仓库授权服务器结构示意图；
图7为实施例二中的镜像仓库服务器结构示意图；
图8-1为实施例三中的身份认证方法示意图；
图8-2为实施例三中的授权认证方法示意图；
图9为实施例三中的授权认证流程示意图；
图10为实施例三中的配置信息示意图；
图11为实施例四中的镜像仓库授权服务器的硬件结构示意图；
图12为实施例四中的镜像仓库客户端的硬件结构示意图；
图13为实施例四中的镜像仓库服务器的硬件结构示意图。
具体实施方式
下面将结合本公开中的附图，对本公开的技术方案进行描述。
实施例一
本实施例中的镜像仓库客户端向镜像仓库授权服务器发送认证请求，镜像仓库授权服务器根据认证请求中的身份信息和预设身份信息与用户角色对应关系表对用户进行授权认证，其中不同用户角色对应不同的访问权限，并在用户授权认证成功后，向镜像仓库客户端反馈的授权令牌；镜像仓库客户端基于该授权令牌向镜像仓库服务器发送镜像资源访问请求，镜像仓库服务器判定该镜像资源访问请求为已授权请求时，对根据镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理。
本实施例提供的镜像仓库访问方法，实现了根据不同用户角色对访问镜像仓库的不同用户的访问权限进行有效控制，能够给镜像仓库提供细粒度的访问控制，提升了镜像仓库的实用性、安全性以及管理的合理性。为了更好的理解本公开的技术方案，本实施例对镜像仓库客户端、镜像仓库服务器以及镜像仓库授权服务器三端分别进行示意说明。
对于镜像仓库客户端，其可以根据用户发送的命令请求向镜像仓库服务器发送镜像资源访问请求，并根据镜像仓库服务器反馈的镜像仓库服务向镜像仓 库授权服务器发送认证请求；也可以在得知镜像仓库授权服务器的地址时，直接根据用户发送的命令请求向镜像仓库授权服务器发送认证请求。实现方式可以根据应用场景灵活选择使用。本实施例提供的一种镜像仓库访问方法参见图1所示，包括以下步骤。
在步骤110中，镜像仓库客户端向镜像仓库授权服务器发送认证请求，该认证请求中至少包含用户的身份信息。
如上所述，本实施例中的认证请求可以是镜像仓库客户端根据镜像仓库服务器的指示发送的，也可以是镜像仓库客户端直接根据用户的指示发送的。
在步骤120中，镜像仓库客户端接收镜像仓库授权服务器根据认证请求中的身份信息和预设身份信息与用户角色对应关系表对用户授权认证成功后，反馈的授权令牌。
本实施例中身份信息和用户角色对应关系表可以是预先配置在镜像仓库授权服务器本地的，也可以是配置在其他镜像仓库授权服务器能够访问获取的数据库中。且本实施例中不同用户角色对应不同的访问权限，本实施例中用户角色以及对应的访问权限的设定可以根据实际应用场景灵活设定。
在步骤130中，镜像仓库客户端基于授权令牌向镜像仓库服务器发送镜像资源访问请求。
本实施例中的镜像仓库客户端发送认证请求、镜像资源访问请求的方式以及所采用的协议都可以根据实际需求灵活设定。本实施例中的镜像仓库可以包括Docker镜像仓库。
如上述分析，在本实施例中，镜像仓库客户端向镜像仓库服务器发送的认证之前，还可以包括图2所示的以下步骤。
在步骤210中，镜像仓库客户端向镜像仓库服务器发送镜像资源访问请求。
镜像仓库服务器接收到该镜像资源访问请求后，会先判断该镜像资源访问请求是否经授权认证过，如是，才执行后续访问步骤，如否，则提示镜像仓库 客户端进行授权认证。
在步骤220中，镜像仓库客户端接收到镜像仓库服务器返回的授权认证指示通知时，根据授权认证指示通知中的镜像仓库授权服务器地址信息，向镜像仓库授权服务器发送所述认证请求。
本实施例中的镜像仓库授权服务器地址信息可以预先在镜像仓库服务器上配置。
本实施例中，镜像仓库客户端向镜像仓库授权服务器发送的认证请求可以包含不同的信息，下面以两种示例情况进行说明。
示例一：镜像仓库客户端发送的认证请求中可以仅包含用户的身份信息，以完成授权认证，此时的授权认证可以仅仅根据该身份信息是否合法进行认证，下发的授权令牌中可以包含该用户对应用户角色的所有访问权限(访问权限中包含用户角色允许访问的镜像资源范围以及允许的操作类型范围)；为了提升安全性，该认证请求中还可以包含用户密码，镜像仓库授权服务器根据认证请求对用户进行授权认证之前，还可先根据身份信息、用户密码和预设身份信息与用户密码对应关系配置文件，对该用户进行身份认证。
示例二：镜像仓库客户端发送的认证请求中可以包含用户的身份信息，当前访问的镜像资源信息(可以是当前访问的镜像资源地址，也可以是当前访问的镜像资源的类型及名称)以及当前访问请求的操作类型；此时的授权认证可以根据该身份信息是否合法，当前访问的镜像资源信息是否在该用户的用户角色允许访问的镜像资源范围内(可以是镜像资源地址范围，也可以是镜像资源的类型范围及名称)，以及当前访问请求的操作类型是否在该用户的用户角色允许的操作类型范围内来进行授权认证。为了提升安全性，该认证请求中也可以包含用户密码，镜像仓库授权服务器根据认证请求对用户进行授权认证之前，还可先根据身份信息、用户密码和预设身份信息与用户密码对应关系配置文件，对该用户进行身份认证。
本实施例中，在对认证请求中的用户授权认证成功后，下发的授权令牌包 含允许用户访问的镜像资源(可以是上述示例一中的该用户的用户角色对应的所有允许访问的镜像资源，也可以是上述示例二中的该用户的用户角色当前允许访问的镜像资源)、操作类型(可以是上述示例一中的该用户的用户角色对应的所有允许的操作类型，也可以是上述示例二中的该用户的用户角色当前允许的操作类型)，还可包括令牌有效时间，该令牌有效时间的设置可以根据实际需求灵活设定，例如设置为10分钟、30分钟等。
镜像仓库客户端基于授权令牌向镜像仓库服务器发送镜像资源访问请求可以采用以下方式中的任意一种方式。
方式一：先将获取到的授权令牌单独发送给镜像仓库服务器，再向镜像仓库服务器发送对应的镜像资源访问请求。
方式二：将包含允许用户访问的镜像资源、操作类型、以及令牌有效时间的授权令牌加入镜像资源访问请求中后，发给镜像仓库服务器。
本实施例中，镜像仓库授权服务器侧执行的镜像仓库授权方法过程参见图3所示，包括以下步骤。
在步骤310中，接收镜像仓库客户端发送的用于访问镜像仓库的认证请求，该认证请求中至少包含用户的身份信息(包括用户名)。
在步骤320中，根据认证请求中的身份信息和预设身份信息与用户角色对应关系表，对用户进行授权认证，不同用户角色对应不同的访问权限。
在步骤330中，授权认证成功时，向镜像仓库客户端反馈授权令牌，以供镜像仓库客户端基于所述授权令牌对所述镜像仓库进行访问。
授权认证失败时，则可以向镜像仓库客户端反馈失败提示，或者不做反馈。
如上述分析，为了提升安全性，本实施例中镜像仓库客户端发送的认证请求中还可以包含用户密码；镜像仓库授权服务器在对认证请求中的用户进行授权认证之前，还可以先根据身份信息以及用户密码，结合预先设置的身份信息与用户密码对应关系配置文件，对用户进行身份认证，在身份认证通过后，执行后续的授权认证过程，如果身份认证不通过，则不执行后续的授权认证过程， 并向镜像仓库客户端反馈认证失败。
如上分析，本实施例中的授权认证方式可包括以下两种示例方式。
示例一：镜像仓库客户端发送的认证请求中可以仅包含用户的身份信息。此时镜像仓库服务器授权认证可以仅仅根据该身份信息，结合预设身份信息与用户角色对应关系表对该用户进行授权认证，例如查看该身份信息在身份信息与用户角色对应关系表中是否存在，如是则授权认证成功，在授权认证成功后，向镜像仓库客户端下发的授权令牌中可以包含该用户对应用户角色的所有访问权限(访问权限中包含用户角色允许访问的镜像资源范围以及允许的操作类型)。
示例二：镜像仓库客户端发送的认证请求中可以包含用户的身份信息，当前访问的镜像资源信息(可以是当前访问的镜像资源地址，也可以是当前访问的镜像资源的类型及名称)以及当前访问请求的操作类型；此时镜像仓库服务器授权认证可以根据该身份信息是否合法，当前访问的镜像资源信息是否在该用户的用户角色允许访问的镜像资源范围内(可以是镜像资源地址范围，也可以是镜像资源的类型范围及名称)，以及当前访问请求的操作类型是否在该用户的用户角色允许的操作类型范围内来进行授权认证。
本实施例中的访问权限中包括用户角色允许访问的镜像资源范围以及允许的操作类型范围，操作类型可以包括上传、下载、删除、查询，例如对于管理员来说，还可具有设置用户角色以及对应的访问权限的权限。下面对用户角色对应的操作类型范围进行示例说明。参见下表1所示。
表1
Figure PCTCN2017107525-appb-000001
Figure PCTCN2017107525-appb-000002
对于镜像资源范围，可以针对不同用户角色分别设定，该镜像资源范围在一种示例中可以通过限定镜像资源地址范围(例如哪个镜像仓库中的哪些地址)进行限定，也可以通过镜像资源的类型及名称进行限定，或者结合二者进行限定。
基于上述表1，假设以上述示例二的认证方式进行认证，此时的镜像仓库认证服务器进行授权认证的过程包括：根据认证请求中的身份信息在预设身份信息与用户角色对应关系表中查找到所述用户对应的用户角色，判断当前访问的镜像资源信息是否在该用户角色允许访问的镜像资源范围内，且当前访问请求的操作类型是否在允许的操作类型范围内，如是，授权认证成功；如否，授权认证失败。
例如，假设认证请求中的身份信息为用户名4，当前的操作类型的为下载，当前访问的镜像资源信息为资源类型为repository名称为test/my-app的镜像文件。此时镜像仓库认证服务器进行授权认证的过程包括：在表1中找到用户名4对应的角色第二用户角色，判定当前操作类型下载在允许的操作类型范围内，且当前访问的镜像资源在允许访问的范围内，授权认证成功。
又例如，假设认证请求中的身份信息为用户名7，当前的操作类型的为删除，当前访问的镜像资源信息为资源类型为repository名称为test/my-app的镜像文件。此时镜像仓库认证服务器进行授权认证的过程包括：在表1中找到用户名7对应的角色第四用户角色，判定当前操作类型删除不在允许的操作类型范围内， 授权认证失败。
又例如，假设认证请求中的身份信息为用户名10，当前的操作类型的为查询，当前访问的镜像资源信息为资源类型为repository名称为test/my-app的镜像文件。此时镜像仓库认证服务器进行授权认证的过程包括：在表1中未找到用户名10，授权认证失败。
本实施例中，镜像仓库服务器侧执行的镜像仓库管理方法过程参见图4所示，包括以下步骤。
在步骤410中，接收镜像仓库客户端发送的镜像资源访问请求。
在步骤420中，判定该镜像资源访问请求是否为授权请求，如该镜像资源访问请求不是授权请求，转至步骤430进行授权认证；如该镜像资源访问请求是授权请求，转至步骤440进行访问处理。
本实施例中，镜像仓库服务器在接收到一个包含授权令牌的镜像资源访问请求(即该镜像资源访问请求为授权请求)时，处理完该镜像资源访问请求后，还可以将该授权令牌进行存储，这样在接收到后续的不包含授权令牌的镜像资源访问请求时，可以根据本地之前存储的授权令牌来判定该镜像资源访问请求是否为授权请求。
在步骤430中，向镜像仓库客户端发送授权认证指示通知，授权认证指示通知包含镜像仓库授权服务器地址信息，采用上述示例二进行授权认证时，还可包括当前访问的镜像资源信息以及操作类型，以供镜像仓库客户端生成认证请求时添加这些信息。
在步骤440中，根据该镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理，例如进行对应的下载、上传、删除及查询等。
对应上述两种示例认证方式，本实施例中根据该镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理的方式也包括以下步骤。
根据镜像资源访问请求对应的令牌有效时间判断该授权令牌当前是否有效，如无效，则向镜像仓库客户端发送重新授权认证指示通知；如有效，则判 断镜像资源访问请求当前访问的镜像资源信息是否在允许访问的镜像资源范围内，且当前访问请求的操作类型是否在允许的操作类型范围内，如是，则执行访问；如否，则拒绝访问或向镜像仓库客户端发送重新授权认证指示通知。本实施例中镜像仓库客户端、镜像仓库服务器以及镜像仓库授权服务器之间多种消息的交互方式可以灵活设定。本实施例实现了根据不同用户角色对访问镜像仓库的不同用户的访问权限进行有效控制，能够给镜像仓库提供细粒度的访问控制，提升了镜像仓库的实用性、安全性以及管理的合理性。
实施例二
本实施例提供了一种镜像仓库客户端，参见图5所示，包括以下模块。
认证处理模块51，设置为向镜像仓库授权服务器发送认证请求，认证请求中至少包含用户的身份信息；以及接收镜像仓库授权服务器根据所述身份信息和预设身份信息与用户角色对应关系表对所述用户授权认证成功后，反馈的授权令牌。
认证处理模块51可以根据用户发送的命令请求向镜像仓库服务器发送镜像资源访问请求，并根据镜像仓库服务器反馈的镜像仓库服务向镜像仓库授权服务器发送认证请求；也可以在得知镜像仓库授权服务器的地址时，直接根据用户发送的命令请求向镜像仓库授权服务器发送认证请求。
本实施例中身份信息和用户角色对应关系表可以是预先配置在镜像仓库授权服务器本地的，也可以是配置在其他镜像仓库授权服务器能够访问获取的数据库中。且本实施例中不同用户角色对应不同的访问权限，本实施例中用户角色以及对应的访问权限的设定可以根据实际应用场景灵活设定。
资源访问模块52，设置为基于授权令牌向镜像仓库服务器发送镜像资源访问请求。
认证处理模块51向镜像仓库授权服务器发送的认证请求可以包含不同的信息，下面以两种示例情况进行说明。
示例一：认证处理模块51发送的认证请求中可以仅包含用户的身份信息， 以完成授权认证，此时的授权认证可以仅仅根据该身份信息是否合法进行认证，下发的授权令牌中可以包含该用户对应用户角色的所有访问权限(访问权限中包含用户角色允许访问的镜像资源范围以及允许的操作类型范围)。
示例二：认证处理模块51发送的认证请求中可以包含用户的身份信息，当前访问的镜像资源信息(可以是当前访问的镜像资源地址，也可以是当前访问的镜像资源的类型及名称)以及当前访问请求的操作类型；此时的授权认证可以根据该身份信息是否合法，当前访问的镜像资源信息是否在该用户的用户角色允许访问的镜像资源范围内(可以是镜像资源地址范围，也可以是镜像资源的类型范围及名称)，以及当前访问请求的操作类型是否在该用户的用户角色允许的操作类型范围内来进行授权认证。
为了提升安全性，该认证请求中还可以包含用户密码，镜像仓库授权服务器根据认证请求对用户进行授权认证之前，还可先根据身份信息、用户密码和预设身份信息与用户密码对应关系配置文件，对该用户进行身份认证。
本实施例中，在对认证请求中的用户授权认证成功后，下发的授权令牌包含允许用户访问的镜像资源(可以是上述示例一中的该用户的用户角色对应的所有允许访问的镜像资源，也可以是上述示例二中的该用户的用户角色当前允许访问的镜像资源)、操作类型(可以是上述示例一中的该用户的用户角色对应的所有允许的操作类型，也可以是上述示例二中的该用户的用户角色当前允许的操作类型)，还可包括令牌有效时间，该令牌有效时间的设置可以根据实际需求灵活设定，例如设置为20分钟、30分钟等。
资源访问模块52基于授权令牌向镜像仓库服务器发送镜像资源访问请求可以采用以下方式中的任意一种方式。
方式一：资源访问模块52先将获取到的授权令牌单独发送给镜像仓库服务器，再向镜像仓库服务器发送对应的镜像资源访问请求。
方式二：资源访问模块52将包含允许用户访问的镜像资源、操作类型、以及令牌有效时间的授权令牌加入镜像资源访问请求中后，发给镜像仓库服务器。
本实施例还提供了一种镜像仓库授权服务器，参见图6所示，包括以下模块。
认证接收模块61，设置为接收镜像仓库客户端发送的用于访问镜像仓库的认证请求，所述认证请求中至少包含用户的身份信息(包括用户名)。
授权认证模块62，设置为根据身份信息和预设身份信息与用户角色对应关系表，对所述用户进行授权认证，不同用户角色对应不同的访问权限。
认证反馈模块63，设置为在授权认证成功时，向镜像仓库客户端反馈授权令牌，以供镜像仓库客户端基于授权令牌对所述镜像仓库进行访问。
授权认证失败时，则可以向镜像仓库客户端反馈失败提示，或者不做反馈。
为了提升安全性，本实施例中镜像仓库客户端发送的认证请求中还可以包含用户密码；参见图6所示，镜像仓库授权服务器还包括身份认证模块64，设置为在对认证请求中的用户进行授权认证之前，还可以先根据身份信息以及用户密码，结合预先设置的身份信息与用户密码对应关系配置文件，对用户进行身份认证，在身份认证通过后，授权认证模块执行后续的授权认证过程，如果身份认证不通过，则不执行后续的授权认证过程，并向镜像仓库客户端反馈认证失败。
如上分析，本实施例中的授权认证方式可包括以下两种示例方式。
示例一：镜像仓库客户端发送的认证请求中可以仅包含用户的身份信息。此时授权认证模块62授权认证可以仅仅根据该身份信息，结合预设身份信息与用户角色对应关系表对该用户进行授权认证，例如查看该身份信息在身份信息与用户角色对应关系表中是否存在，如是则授权认证成功，在授权认证成功后，向镜像仓库客户端下发的授权令牌中可以包含该用户对应用户角色的所有访问权限(访问权限中包含用户角色允许访问的镜像资源范围以及允许的操作类型范围)。
示例二：镜像仓库客户端发送的认证请求中可以包含用户的身份信息，当前访问的镜像资源信息(可以是当前访问的镜像资源地址，也可以是当前访问 的镜像资源的类型及名称)以及当前访问请求的操作类型；此时授权认证模块62授权认证可以根据该身份信息是否合法，当前访问的镜像资源信息是否在该用户的用户角色允许访问的镜像资源范围内(可以是镜像资源地址范围，也可以是镜像资源的类型范围及名称)，以及当前访问请求的操作类型是否在该用户的用户角色允许的操作类型范围内来进行授权认证。
本实施例中的访问权限中包括用户角色允许访问的镜像资源范围以及允许的操作类型范围，操作类型包括但不限于上传、下载、删除、查询，例如对于管理员来说，还可具有设置用户角色以及对应的访问权限的权限。
本实施例还提供了一种镜像仓库服务器，参见图7所示，包括以下模块。
访问接收模块71，设置为接收镜像仓库客户端发送的镜像资源访问请求。
控制模块72，设置为判定该镜像资源访问请求为未授权请求时，向镜像仓库客户端发送授权认证指示通知，授权认证指示通知包含镜像仓库授权服务器地址信息，采用上述示例二进行授权认证时，还可包括当前访问的镜像资源信息以及操作类型，以供镜像仓库客户端生成认证请求时添加这些信息；控制模块72还设置为判定该镜像资源访问请求为已授权请求时，根据该镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理。
本实施例中，控制模块72在接收到一个包含授权令牌的镜像资源访问请求时，处理完该镜像资源访问请求后，还可以将该授权令牌进行存储，这样在接收到后续的不包含授权令牌的镜像资源访问请求时，可以根据本地之前存储的授权令牌来判定该镜像资源访问请求是否为授权请求。
控制模块72是设置为根据所述授权令牌有效时间判断所述授权令牌当前是否有效，如无效，向所述镜像仓库客户端发送重新授权认证指示通知；如有效，判断所述镜像资源访问请求当前访问的镜像资源信息是否在允许访问的镜像资源范围内，且所述当前访问请求的操作类型是否在允许的操作类型范围内，如是，执行访问；如否，拒绝访问或向所述镜像仓库客户端发送重新授权认证指示通知。
本实施例中的上述多个模块的功能可以由微控制器内的电路或代码实现。也即本实施例的模块或步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在计算机存储介质(ROM/RAM、磁碟、光盘)中由计算装置来执行，并且在一些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成多个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。
实施例三
本实施例镜像仓库为Docker镜像仓库为示例，结合上述示例二的方式对本公开的技术方案进行说明。
本实施例中身份认证模块的功能是接收Docker的认证请求，通过指定的认证方法进行身份认证。本实施例中的认证请求可以使用安全套接字层超文本传输协议(Hyper Text Transfer Protocol over Secure Socket Layer，HTTPS)，用于安全的超文本传输协议(Hyper Text Transfer Protocol，HTTP)数据传输。
如图8-1所示，身份认证模块可以支持多种认证方法，例如可以包括以下步骤。
在步骤811中，将用户名和加密的密码放在配置文件中。
静态文件配置方式即为把用户名和加密的密码放在配置的文件中，授权装置运行时载入该配置文件，配置文件配置了当前用户名及密码，其中密码采用了一个跨平台的文件加密工具(Blowfish File Encryption，B-crypt)加密，该方式实施简单。
在步骤812中，以树状的层次结构来存储数据，启动一个运行LDAP服务 器的容器，并通过配置文件方式，配置LDAP服务器的地址及其他信息。
轻量目录访问协议(Lightweight Directory Access Protocol，LDAP)，即以树状的层次结构来存储数据，需要启动一个运行LDAP服务器的容器，然后，授权装置通过配置文件方式，配置上述的LDAP服务器的地址及其他信息。
在步骤813中，载入配置数据库的地址端口等信息的配置文件，通过读取数据库存储的用户数据来进行认证。
多种数据库，在授权装置启动时，载入了配置数据库的地址端口等信息的配置文件，镜像仓库的每一次操作，通过读取数据库存储的用户数据来进行认证。
本实施例中的授权认证模块的功能是当身份认证通过，根据认证请求中的用户信息和所请求的授权范围(包括访问的资源类型、名称以及具体操作类型)下发授权令牌token，该token通过JWT(JSON Web Token)认证方案生成，该token包含了token类型(即JWT)，token使用的签名算法，token的发行方，token的有效期等。如图8-2所示，授权认证方法包括以下步骤。
在步骤821中，将用户名和该用户名具有的权限范围放在配置文件中。
访问控制列表(Access Control List，ACL)授权方法可同上面的静态文件配置配合使用，配置文件中，描述用户名和该用户名具有的权限范围。
在步骤822中，通过配置文件方式，配置LDAP服务器的地址及其他信息。
LDAP的授权可配合LDAP认证使用。
在步骤823中，载入配置数据库的地址端口等信息的配置文件，通过读取数据库存储的用户数据来进行授权。
数据库的授权方法，可配同上面的数据库认证是一起使用的，通过数据库存储数据进行授权具有更丰富使用场景，使用者可以根据需要自行选择数据库 类型。
图9展示了授权认证的完成过程，包括以下步骤。
在步骤910中，镜像仓库客户端向镜像仓库服务器发起资源访问请求。
在步骤920中，镜像仓库服务器返回授权地址和根据请求的地址生成的授权范围。
在步骤930中，镜像仓库客户端携带用户名和密码向镜像仓库授权服务器发送认证请求。
在步骤940中，镜像仓库授权服务器首先对用户信息及请求范围进行认证，认证通过后，发送授权令牌token给镜像仓库客户端。
在步骤950中，镜像仓库客户端携带该token再次向镜像仓库服务器发起资源访问请求。
在步骤960中，镜像仓库服务器收到资源访问请求后对请求资源进行响应。
下面以镜像下载为例，介绍通用的Docker镜像仓库授权服务器对Docker镜像仓库服务器进行认证授权过程如下。
首先保证Docker镜像仓库服务器已经正常启动，其中启动载入了配置的镜像仓库授权服务器信息，包括镜像仓库授权服务器地址，镜像仓库的名称也可以称为服务名称，镜像仓库授权服务器名称即token的发行方，以及公钥的绝对路径(配合HTTPS使用)。镜像仓库授权服务器也要启动，载入包含token的配置信息，其中授权装置的名称同上面Docker镜像仓库服务器配置的必须一致，还要配置token的有效期。
Docker镜像仓库客户端接收到用户发出的命令请求。比如以Docker Registry镜像仓库为例，镜像仓库客户端使用用户名和密码登录Docker Registry，比如当前有用户test，使用命令docker login 10.11.21.22：5000，10.11.21.22：5000即 Docker Registry的地址，
登录成功后，执行了docker pull 10.11.21.22：5000：test/my-app命令把镜像从镜像仓库服务器下载到本地Docker。
Docker镜像仓库服务器因为该资源访问请求未经过授权服务器授权，返回一个状态码为401的HTTP响应，在响应头部包含了授权装置的地址，服务名称，对于Docker Registry，服务端名称可以设置为DIS-Registry，同时，还包含了操作的范围，在响应消息头里，WWW-Authenticate头域的值可以是如下格式：Bearer realm＝″https：//ip：port/auth″，service＝″Docker-Registry″，scope＝″repository：test/my-app：pull″。其中，realm即授权服务器的地址，service即服务名称，scope描述了请求的资源类型，资源名称和操作范围，当前资源类型为repository，开发者可以根据需要扩展资源类型，请求的资源名称。本实施例中要下载的镜像名称为test/my-app，需要执行操作动作是下载，即pull。操作可以包含三种类型：*(表示具有镜像操作的全部权限)，push，pull(表示具有镜像上传下载权限)，pull(表示具有镜像下载权限)。scope可以有多个，即能够同时对多个资源进行授权。
镜像仓库客户端根据上述的授权信息，发送认证请求到镜像仓库授权服务器，请求地址可以是：https：//ip：port/auth？service＝Docker-Registry&scope＝repository：test/my-app：pull，同时使用HTTP基本认证输入用户名和密码，发送HTTPS请求到镜像仓库授权服务器，该镜像仓库授权服务器首先根据配置的认证方法对请求的用户名和密码进行认证，比如，认证方法使用PostgreSQL数据库，装置把请求的用户名和密码同数据库存储的用户名密码做对比，同时，对于scope里描述的资源类型，名称以及操作进行数据库内容的查询对比，一致就继续进行授权，如果不一致，即为认证不通过，返回状态码为401的响应信息， 以及认证不通过的原因。
镜像仓库授权服务器根据上述所需的scope返回token，表示得到访问权限。通过HTTP返回响应消息体，包含生成的token。
镜像仓库客户端重新发送资源访问请求发送到Docker镜像仓库服务器，在发送的消息头里增加Authorization头域，即在token值的前面加上Bearer及一个空格。
Docker镜像仓库服务器收到含token的资源访问请求，执行镜像仓库客户端请求资源的所需操作，即下载镜像到本地Docker。
对于镜像仓库客户端相同的请求，在token有效期内，可以直接执行，无需重新认证在保证安全性的同时提高了操作的效率。
镜像仓库授权服务器可以快速方便的与Docker镜像仓库整合，Docker镜像仓库通过上述一系列的认证授权步骤达到了细粒度的访问控制。
综上所述，通用的Docker授权方法及装置实现了对Docker镜像仓库操作的访问控制，通过镜像方式方便的部署到Docker中，提高了Docker镜像仓库开发的效率。
实施例四
本实施例提供一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行上述方法。
如图11所示，是本实施例提供的一种镜像仓库授权服务器的硬件结构示意图，如图11所示，该镜像仓库授权服务器包括：处理器(processor)111和存储器(memory)112；还可以包括通信接口(Communications Interface)113和总线114。
其中，处理器111、存储器112和通信接口113可以通过总线114完成相互间的通信。通信接口113可以用于信息传输。处理器111可以调用存储器112 中的逻辑指令，以执行上述实施例的任意一种镜像仓库授权方法。
如图12所示，是本实施例提供的一种镜像仓库客户端的硬件结构示意图，如图12所示，该镜像仓库客户端包括：处理器121和存储器122；还可以包括通信接口123和总线124。
其中，处理器121、存储器122和通信接口123可以通过总线124完成相互间的通信。通信接口123可以用于信息传输。处理器121可以调用存储器122中的逻辑指令，以执行上述实施例的任意一种镜像仓库访问方法。
如图13所示，是本实施例提供的一种镜像仓库服务器的硬件结构示意图，如图13所示，该镜像仓库服务器包括：处理器131和存储器132；还可以包括通信接口133和总线134。
其中，处理器131、存储器132和通信接口133可以通过总线132完成相互间的通信。通信接口133可以用于信息传输。处理器131可以调用存储器132中的逻辑指令，以执行上述实施例的任意一种镜像仓库管理方法。
上述存储器可以包括存储程序区和存储数据区，存储程序区可以存储操作系统和至少一个功能所需的应用程序。存储数据区可以存储根据电子设备的使用所创建的数据等。此外，存储器可以包括，例如，随机存取存储器的易失性存储器，还可以包括非易失性存储器。例如至少一个磁盘存储器件、闪存器件或者其他非暂态固态存储器件。
此外，在上述存储器中的逻辑指令可以通过软件功能单元的形式实现并作为独立的产品销售或使用时，该逻辑指令可以存储在一个计算机可读取存储介质中。本公开的技术方案可以以计算机软件产品的形式体现出来，该计算机软件产品可以存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本实施例所述方法的全部或 部分步骤。
存储介质可以是非暂态存储介质，也可以是暂态存储介质。非暂态存储介质可以包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等多种可以存储程序代码的介质。
实现上述实施例方法中的全部或部分流程，是可以通过计算机程序来指示相关的硬件完成的，该程序可存储于一个非暂态计算机可读存储介质中，该程序被执行时，可包括如上述方法的实施例的流程。
工业实用性
本公开提供的镜像仓库授权、访问、管理方法、服务器及客户端，可以根据不同用户角色对访问镜像仓库的不同用户的访问权限进行有效控制，能够给镜像仓库提供细粒度的访问控制，提升了镜像仓库的实用性、安全性以及管理的合理性。

Claims (14)

  1. 一种镜像仓库授权方法，应用于镜像仓库授权服务器，包括：
    接收镜像仓库客户端发送的用于访问镜像仓库的认证请求，所述认证请求至少包含用户的身份信息；
    根据所述身份信息和预设的对应关系表，对所述用户进行授权认证，所述对应关系表的内容为身份信息与用户角色的对应关系，不同用户角色对应不同的访问权限；
    授权认证成功时，向所述镜像仓库客户端反馈授权令牌。
  2. 如权利要求1所述的镜像仓库授权方法，其中，所述认证请求还包含用户密码；
    所述根据所述身份信息和预设的对应关系表对所述用户进行授权认证之前，所述方法还包括根据所述用户密码和预设的配置文件，对所述用户进行身份认证，所述配置文件的内容为身份信息与用户密码的对应关系。
  3. 如权利要求1或2所述的镜像仓库授权方法，其中，所述认证请求还包括用户访问的镜像资源信息以及用户访问请求的操作类型；所述访问权限中包含用户角色允许访问的镜像资源范围以及允许的操作类型；所述操作类型包含上传、下载、删除和查询；
    所述根据所述身份信息和预设的对应关系表，对所述用户进行授权认证包括：
    根据所述身份信息在所述对应关系表中查找到所述用户对应的用户角色；
    判断所述用户访问的镜像资源信息是否在所述用户角色允许访问的镜像资源范围内，且所述用户访问请求的操作类型是否为所述用户角色允许执行的操作类型内，如是，则授权认证成功；如否，则授权认证失败。
  4. 一种镜像仓库访问方法，应用于镜像仓库客户端，包括：
    向镜像仓库授权服务器发送认证请求，所述认证请求至少包含用户的身份信息；
    接收所述镜像仓库授权服务器根据所述身份信息和预设的对应关系表对所述用户授权认证成功后，反馈的授权令牌，所述对应关系表的内容为身份信息与用户角色的对应关系；
    基于所述授权令牌向镜像仓库服务器发送镜像资源访问请求。
  5. 如权利要求4所述的镜像仓库访问方法，其中，向镜像仓库授权服务器发送认证请求之前，所述方法还包括：
    向镜像仓库服务器发送镜像资源访问请求；
    接收到所述镜像仓库服务器返回的授权认证指示通知时，根据所述授权认证指示通知中的镜像仓库授权服务器地址信息，向所述镜像仓库授权服务器发送所述认证请求。
  6. 如权利要求4或5所述的镜像仓库访问方法，其中，所述授权令牌包含允许所述用户访问的镜像资源、操作类型、以及令牌有效时间；所述基于所述授权令牌向镜像仓库服务器发送镜像资源访问请求包括：
    将所述包含允许所述用户访问的镜像资源、操作类型、以及令牌有效时间的授权令牌加入镜像资源访问请求中后，发给所述镜像仓库服务器。
  7. 一种镜像仓库管理方法，应用于镜像仓库服务器，包括：
    接收镜像仓库客户端发送的镜像资源访问请求；
    判定该镜像资源访问请求为未授权请求时，向所述镜像仓库客户端发送授权认证指示通知，所述授权认证指示通知包含镜像仓库授权服务器地址信息；
    判定该镜像资源访问请求为已授权请求时，根据该镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理。
  8. 如权利要求7所述的镜像仓库管理方法，其中，所述授权令牌包含允许用户访问的镜像资源、操作类型、以及令牌有效时间；
    所述根据该镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理包括：
    根据所述令牌有效时间判断所述授权令牌是否有效，如无效，则向所述镜像仓库客户端发送重新授权认证指示通知；
    如有效，则判断所述镜像资源访问请求访问的镜像资源信息是否在允许访问的镜像资源范围内，且所述访问请求的操作类型是否为允许执行的操作类型，如是，则执行访问；如否，则拒绝访问或向所述镜像仓库客户端发送重新授权认证指示通知。
  9. 一种镜像仓库授权服务器，包括：
    认证接收模块，设置为接收镜像仓库客户端发送的用于访问镜像仓库的认证请求，所述认证请求至少包含用户的身份信息；
    授权认证模块，设置为根据所述身份信息和预设的对应关系表，对所述用户进行授权认证，所述对应关系表的内容为身份信息与用户角色的对应关系，不同用户角色对应不同的访问权限；
    认证反馈模块，设置为在授权认证成功时，向所述镜像仓库客户端反馈授权令牌。
  10. 如权利要求9所述的镜像仓库授权服务器，其中，所述认证请求中还包括用户访问的镜像资源信息以及用户访问请求的操作类型；所述访问权限中包含用户角色允许访问的镜像资源范围以及允许的操作类型；所述操作类型包含上传、下载、删除和查询；
    所述授权认证模块是设置为根据所述身份信息在所述预设的对应关系表中 查找到所述用户对应的用户角色，判断所述用户访问的镜像资源信息是否在该用户角色允许访问的镜像资源范围内，且所述用户访问请求的操作类型是否为该用户角色允许执行的操作类型，如是，则授权认证成功；如否，则授权认证失败。
  11. 一种镜像仓库客户端，包括：
    认证处理模块，设置为向镜像仓库授权服务器发送认证请求，所述认证请求至少包含用户的身份信息，以及接收所述镜像仓库授权服务器根据所述身份信息和预设的对应关系表对所述用户授权认证成功后，反馈的授权令牌，所述对应关系表的内容为身份信息与用户角色的对应关系；
    资源访问模块，设置为基于所述授权令牌向镜像仓库服务器发送镜像资源访问请求。
  12. 一种镜像仓库服务器，包括：
    访问接收模块，设置为接收镜像仓库客户端发送的镜像资源访问请求；
    控制模块，设置为判定该镜像资源访问请求为未授权请求时，向所述镜像仓库客户端发送授权认证指示通知，所述授权认证指示通知包含镜像仓库授权服务器地址信息；以及判定该镜像资源访问请求为已授权请求时，根据该镜像资源访问请求对应的授权令牌对该镜像资源访问请求进行访问处理。
  13. 如权利要求12所述的镜像仓库服务器，其中，所述授权令牌包含允许用户访问的镜像资源、操作类型、以及令牌有效时间；
    所述控制模块是设置为根据所述令牌有效时间判断所述授权令牌是否有效，如无效，则向所述镜像仓库客户端发送重新授权认证指示通知；如有效，则判断所述镜像资源访问请求访问的镜像资源信息是否在允许访问的镜像资源范围内，且所述访问请求的操作类型是否为允许执行的操作类型范围内，如是， 则执行访问；如否，则拒绝访问或向所述镜像仓库客户端发送重新授权认证指示通知。
  14. 一种计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令用于执行权利要求1-8任一项的方法。
PCT/CN2017/107525 2016-10-31 2017-10-24 镜像仓库授权、访问、管理方法、服务器和客户端 WO2018077169A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610978489.9A CN108011862A (zh) 2016-10-31 2016-10-31 镜像仓库授权、访问、管理方法及服务器和客户端
CN201610978489.9 2016-10-31

Publications (1)

Publication Number Publication Date
WO2018077169A1 true WO2018077169A1 (zh) 2018-05-03

Family

ID=62024415

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/107525 WO2018077169A1 (zh) 2016-10-31 2017-10-24 镜像仓库授权、访问、管理方法、服务器和客户端

Country Status (2)

Country Link
CN (1) CN108011862A (zh)
WO (1) WO2018077169A1 (zh)

Cited By (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109783076A (zh) * 2018-12-14 2019-05-21 深圳壹账通智能科技有限公司 基于git的代码管理方法、装置、设备和存储介质
CN111130852A (zh) * 2019-12-04 2020-05-08 上海交通大学包头材料研究院 一种基于Docker的云应用网络自动化部署的方法
CN111241503A (zh) * 2020-01-16 2020-06-05 上海上实龙创智慧能源科技股份有限公司 一种基于Vue.js框架的页面按钮授权方法
CN112506613A (zh) * 2020-12-11 2021-03-16 四川长虹电器股份有限公司 Gitlab-ci自动识别Maven变更子模块并推送docker镜像的方法
CN113452652A (zh) * 2020-03-24 2021-09-28 深圳法大大网络科技有限公司 基于多系统的数据交互方法、装置、电子设备及存储介质
CN115174174A (zh) * 2022-06-24 2022-10-11 百融至信(北京)征信有限公司 控制电子管理平台的方法和装置
CN115174162A (zh) * 2022-06-17 2022-10-11 青岛海尔科技有限公司 基于OAuth协议的授权方法、装置、系统及存储介质
CN117852005A (zh) * 2024-03-08 2024-04-09 杭州悦数科技有限公司 一种图数据库与客户端之间的安全校验方法及系统

Families Citing this family (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107239688B (zh) * 2017-06-30 2019-07-23 平安科技（深圳）有限公司 Docker镜像仓库的权限认证方法和系统
CN108924101A (zh) * 2018-06-20 2018-11-30 北京车和家信息技术有限公司 一种数据库的操作方法及相关设备
CN109033774B (zh) * 2018-08-31 2020-08-07 阿里巴巴集团控股有限公司 获取、反馈用户资源的方法、装置及电子设备
CN110022294A (zh) * 2019-02-27 2019-07-16 广州虎牙信息科技有限公司 一种代理服务器、Docker系统及其权限管理方法、存储介质
CN110120979B (zh) * 2019-05-20 2023-03-10 华为云计算技术有限公司 一种调度方法、装置及相关设备
CN112182522A (zh) * 2019-07-05 2021-01-05 北京地平线机器人技术研发有限公司 访问控制方法和装置
CN111190738B (zh) * 2019-12-31 2023-09-08 北京仁科互动网络技术有限公司 多租户体系下的用户镜像方法、装置及系统
CN111966868B (zh) * 2020-09-07 2021-04-06 航天云网数据研究院(广东)有限公司 基于标识解析的数据治理方法及相关设备
CN112363806B (zh) * 2020-11-23 2023-09-22 北京信安世纪科技股份有限公司 一种集群管理方法、装置、电子设备及存储介质
CN112667998B (zh) * 2020-12-08 2024-03-01 中国科学院信息工程研究所 一种容器镜像仓库的安全访问方法及系统
CN113190609B (zh) * 2021-05-28 2023-11-03 腾讯科技（深圳）有限公司 数据仓库管理方法及系统、装置、存储介质、电子设备
CN115460022B (zh) * 2022-11-11 2023-03-07 广州中长康达信息技术有限公司 一种对智能辅助平台的资源管理方法
CN117034233B (zh) * 2023-10-09 2024-01-23 统信软件技术有限公司 基于权限的应用管理方法、装置、计算设备及存储介质
CN117118751B (zh) * 2023-10-23 2024-01-30 城云科技（中国）有限公司 基于OAuth2的访问控制模型的拓展方法及其应用

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104506628A (zh) * 2014-12-25 2015-04-08 深圳市科漫达智能管理科技有限公司 一种插件仓库管理方法与系统
US20160105402A1 (en) * 2014-07-22 2016-04-14 Harsh Kupwade-Patil Homomorphic encryption in a healthcare network environment, system and methods
CN105653901A (zh) * 2015-12-29 2016-06-08 深圳市科漫达智能管理科技有限公司 一种组件仓库管理的方法及系统
CN106845183A (zh) * 2017-01-24 2017-06-13 郑州云海信息技术有限公司 一种应用容器引擎管理方法及系统
CN107239688A (zh) * 2017-06-30 2017-10-10 平安科技（深圳）有限公司 Docker镜像仓库的权限认证方法和系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160105402A1 (en) * 2014-07-22 2016-04-14 Harsh Kupwade-Patil Homomorphic encryption in a healthcare network environment, system and methods
CN104506628A (zh) * 2014-12-25 2015-04-08 深圳市科漫达智能管理科技有限公司 一种插件仓库管理方法与系统
CN105653901A (zh) * 2015-12-29 2016-06-08 深圳市科漫达智能管理科技有限公司 一种组件仓库管理的方法及系统
CN106845183A (zh) * 2017-01-24 2017-06-13 郑州云海信息技术有限公司 一种应用容器引擎管理方法及系统
CN107239688A (zh) * 2017-06-30 2017-10-10 平安科技（深圳）有限公司 Docker镜像仓库的权限认证方法和系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
YANG, TING: "Management Method for Isolated Public Database and Hierarchical Security", MICROCOMPUTER APPLICATIONS, no. 4, 31 August 2006 (2006-08-31), pages 446 *

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109783076A (zh) * 2018-12-14 2019-05-21 深圳壹账通智能科技有限公司 基于git的代码管理方法、装置、设备和存储介质
CN111130852A (zh) * 2019-12-04 2020-05-08 上海交通大学包头材料研究院 一种基于Docker的云应用网络自动化部署的方法
CN111241503A (zh) * 2020-01-16 2020-06-05 上海上实龙创智慧能源科技股份有限公司 一种基于Vue.js框架的页面按钮授权方法
CN113452652A (zh) * 2020-03-24 2021-09-28 深圳法大大网络科技有限公司 基于多系统的数据交互方法、装置、电子设备及存储介质
CN112506613A (zh) * 2020-12-11 2021-03-16 四川长虹电器股份有限公司 Gitlab-ci自动识别Maven变更子模块并推送docker镜像的方法
CN115174162A (zh) * 2022-06-17 2022-10-11 青岛海尔科技有限公司 基于OAuth协议的授权方法、装置、系统及存储介质
CN115174162B (zh) * 2022-06-17 2023-10-24 青岛海尔科技有限公司 基于OAuth协议的授权方法、装置、系统及存储介质
CN115174174A (zh) * 2022-06-24 2022-10-11 百融至信(北京)征信有限公司 控制电子管理平台的方法和装置
CN115174174B (zh) * 2022-06-24 2024-04-12 百融至信(北京)科技有限公司 控制电子管理平台的方法和装置
CN117852005A (zh) * 2024-03-08 2024-04-09 杭州悦数科技有限公司 一种图数据库与客户端之间的安全校验方法及系统
CN117852005B (zh) * 2024-03-08 2024-05-14 杭州悦数科技有限公司 一种图数据库与客户端之间的安全校验方法及系统

Also Published As

Publication number Publication date
CN108011862A (zh) 2018-05-08

Similar Documents

Publication Publication Date Title
WO2018077169A1 (zh) 镜像仓库授权、访问、管理方法、服务器和客户端
US11881937B2 (en) System, method and computer program product for credential provisioning in a mobile device platform
US10897464B2 (en) Device registration, authentication, and authorization system and method
CN110784433B (zh) 一种用户访问处理方法、装置及设备
US9942274B2 (en) Securing communication over a network using client integrity verification
CA2982539C (en) Method of operating a computing device, computing device and computer program
US10681023B2 (en) Self-service portal for provisioning passwordless access
US10511584B1 (en) Multi-tenant secure bastion
US20170034216A1 (en) Authorizing application access to virtual private network resource
EP2954638B1 (en) System and method for validating scep certificate enrollment requests
US9576150B1 (en) Validating a user of a virtual machine for administrator/root access
AU2019370092B2 (en) Centralized authentication and authorization
US20170310480A1 (en) Access to software applications
WO2023160632A1 (zh) 针对飞地实例的云服务访问权限设置方法和云管理平台
US20230283472A1 (en) Credential-Free Authentication Systems and Methods
US20220311777A1 (en) Hardening remote administrator access

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17865128

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17865128

Country of ref document: EP

Kind code of ref document: A1