WO2019127973A1

WO2019127973A1 - Authority authentication method, system and device for mirror repository, and storage medium

Info

Publication number: WO2019127973A1
Application number: PCT/CN2018/082269
Authority: WO
Inventors: 刘俊杰
Original assignee: 平安科技（深圳）有限公司
Priority date: 2017-12-29
Filing date: 2018-04-09
Publication date: 2019-07-04
Also published as: CN107948201B; CN107948201A

Abstract

Disclosed are an authority authentication method and system for a mirror repository. The authority authentication method comprises: first, when access to a Docker mirror repository by means of a proxy server is rejected, receiving unauthorized error information returned by the mirror repository; then, parsing the authorized error information, generating an authority authentication request according to authentication method prompt information, and sending same to the proxy server, so that the proxy server sends the authority authentication request to a token server for authority authentication; then, receiving a token returned by the token server in a cloud management area, and sending an access request carrying the token to the mirror repository; and receiving a mirror returned by the mirror repository, so that the operation of accessing a private Docker mirror repository is completed.

Description

Authenticated authentication method, system, device and storage medium for mirrored warehouse

This application claims the priority of the Chinese Patent Application filed on Dec. 29, 2017, the Chinese Patent Office, the application number is 201711476882.9, and the invention is entitled "Authorization Method and System for Docker Image Warehouse", the entire contents of which are incorporated by reference. in.

Technical field

The present application relates to the field of Docker technology, and specifically relates to a method, system, device and storage medium for authenticating a mirror warehouse.

Background technique

Docker (Docker Is an open source application container engine that allows developers to package their applications and dependencies into a portable container and then publish them to any popular Linux On the machine, virtualization can also be implemented. The container technology provided allows several containers to be run on the same host or virtual machine, each container being a separate virtual environment or application.

Container from Docker Mirroring, which can be generated by the user or by a running container commit. After the image is generated, it can be pushed to the image repository for saving or mirroring. The repository pulls to the local to run the container.

Docker provides an official image repository (Docker hub), while allowing users to build their own private image repository (private Registry). For most organizations and organizations, it is necessary to use a private image repository to protect the mirrored content and use of the repository.

When a user accesses a Docker image, the access control needs to be refined for images in different mirrored warehouses. For example, for a public image (that is, access to the official image repository), any user can pull (Pull) the image, and only the system administrator can push (Push) the image; for the user's own namespace (Name Mirror under space) (ie private Docker) Mirroring warehouse), only the user who has passed the authorization verification can pull/push the image, that is, when accessing, it is necessary to judge which mirrors in the warehouse can be pulled according to the identity of the user terminal, or which mirrors can be pushed to which warehouse. Can improve the security of the image.

At present, the permission setting of the Docker image server is relatively simple, generally adopting two methods. The first way is to check whether the user authentication information is provided together at the request, and does not verify the true and false; the second way is to configure static The username and password are correct, and the password file needs to be generated in advance. The mirror service can be operated by simple user login.

It can be seen that the above two methods of access control are not secure enough to meet the requirements of mirror security.

Therefore, the prior art has yet to be improved and developed.

Application content

In view of the above-mentioned deficiencies of the prior art, the present application provides a method, system, device and storage medium for authenticating a mirror warehouse, which mainly solves the problem that the existing Docker image access is not secure.

The technical solution adopted by the present application to solve the technical problem is as follows:

A method for authenticating a mirrored warehouse includes the following steps:

When the access to the Docker image repository is denied by the proxy server, the unauthorized error information returned by the mirrored warehouse is received, wherein the mirrored warehouse is deployed in the cloud management area, and the response header of the unauthorized error information includes the authentication method prompt information;

Parsing the unauthorized error information, generating a rights authentication request according to the authentication method prompt information, and sending the permission authentication request to the proxy server, where the proxy server sends the rights authentication request to the token server for rights authentication, where the proxy server is deployed in the available area The token server is deployed in the cloud management area;

Receiving a token returned by the token server in the cloud management area, and carrying the token to send an access request to the mirror warehouse;

Receive the image returned by the mirror repository.

Optionally, the parsing the unauthorized error information, generating a rights authentication request according to the authentication method prompt information, and sending the permission authentication request to the proxy server, and the step of the proxy server sending the rights authentication request to the token server for performing the rights authentication includes:

Parsing the unauthorized error information, and obtaining an authentication error prompt message in the response header for obtaining the unauthorized error information;

Prompting the authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information;

The authority authentication request information is sent to the proxy server, and the proxy server sends the authority authentication request to the token server for authority authentication.

Optionally, the step of generating the rights authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information includes:

The user authentication information is encrypted according to the authentication method prompt information, placed in the request header of the https request, and the requested mirror content range is placed in the request parameter of the https request, and the permission authentication request is generated based on the request header and the request parameter of the https request. information.

Optionally, after the step of sending the rights authentication request information to the proxy server, the proxy server sends the rights authentication request to the token server for the rights authentication, and receives the token returned by the token server in the cloud management area, and Before the step of sending the access request to the mirror warehouse, the rights authentication method further includes:

The proxy server performs secure transport layer protocol authentication according to the domain name entered by the client, and receives the data access request of the client after the verification is passed and sends it to the token server of the cloud management area;

The token server of the cloud management area parses the authority authentication request information, and verifies the user authentication information;

When the user authentication is passed, it is determined according to the scope of the requested mirror content whether the client can access the mirrored content of the request;

When the client can access the requested mirrored content, the token is generated and returned to the client according to the user authentication information and the requested mirrored content range.

Optionally, after the step of receiving the token returned by the token server in the cloud management zone and carrying the token to send the access request to the mirroring warehouse, and before receiving the mirror image returned by the mirroring warehouse, the method further includes:

The mirror repository receives the token, parses and verifies the token, and returns a mirror to the client when the verification passes.

A permission authentication system for a mirrored warehouse, comprising a plurality of available zones, each of which is provided with a rights authentication device and a proxy server,

The authorization authentication device is configured to access the mirrored warehouse, and when the access mirror warehouse is rejected, receiving the unauthorized error information returned by the mirror warehouse, where the response header of the unauthorized error information includes the authentication method prompt information; And parsing the unauthorized error information, and generating a rights authentication request according to the authentication method prompt information and sending it to the proxy server; and receiving the token returned by the token server; and carrying the token to send the access to the mirror warehouse Request; and receive the image returned by the mirror repository;

The proxy server is configured to send a rights authentication request to a token server of the cloud management area.

Optionally, the rights authentication system of the mirrored warehouse further includes a token server disposed in the cloud management zone, the token server is configured to parse the authority authentication request information, and verify user authentication information; and authenticate the user. When passing, determining whether the client can access the requested mirrored content according to the scope of the requested mirrored content; and when the client can access the requested mirrored content, generating a token according to the user authentication information and the requested mirrored content range is returned to the client end.

Optionally, the proxy server is further configured to perform a secure transport layer protocol authentication according to the domain name input by the client, and receive the data access request of the client after the verification is passed and send the data access request to the token server of the cloud management area.

Optionally, the number of the token servers is one.

Optionally, the rights authentication system of the mirror warehouse further includes a mirror warehouse disposed in the cloud management area, the image warehouse is configured to receive the token, parse and verify the token, and when the verification passes, to the client Return to the image.

A rights authentication device for mirroring a warehouse, the rights authentication device comprising a processor, a memory, and a rights authentication program stored on the memory and executable by the processor, the rights authentication program being used by the processor When executed, implement the following steps:

Receive the image returned by the mirror repository.

A storage medium storing a rights authentication program, the rights authentication program being executed by a processor, implementing the following steps:

Receive the image returned by the mirror repository.

In the privilege authentication method, system, device, and storage medium of the mirror warehouse disclosed in the present application, the privilege authentication method first receives the unauthorized error information returned by the mirror warehouse when the proxy server accesses the mirror warehouse is rejected, wherein the mirror warehouse Deployed in the cloud management area, the response header of the unauthorized error information includes authentication method prompt information; afterwards, the unauthorized error information is parsed, and the authority authentication request is generated according to the authentication method prompt information and sent to the proxy server, The proxy server sends a rights authentication request to the token server for rights authentication, wherein the proxy server is deployed in the available area, and the token server is deployed in the cloud management area; afterwards, the token returned by the token server in the cloud management area is received, And carrying the token to send an access request to the mirror warehouse; receiving the image returned by the mirror warehouse, that is, completing the private Docker The access operation of the mirrored warehouse. By applying the authority authentication to the third party for verification, the application improves the security of the image according to the request token issuance authority, and by setting the token server in the cloud management area, it is no longer necessary to set the authentication component in each available area, avoiding each When performing the rights authentication, the API of the cloud management area needs to be called to authenticate the user's domain account, which avoids the waste of resources. After using the proxy server, since the maintenance of the proxy server is much less difficult than the authentication component of the self-research, only the need is needed. Maintain a token server in the cloud zone.

DRAWINGS

1 is a flowchart of a preferred embodiment of a method for authenticating a mirrored warehouse provided by the present application;

2 is a flowchart of a preferred embodiment of step S20 in the method for authenticating a mirrored warehouse provided by the present application;

3 is a functional block diagram of a preferred embodiment of a rights authentication system for a mirrored warehouse provided by the present application;

4 is a functional block diagram of a preferred embodiment of the rights authentication device in the rights authentication system of the mirrored warehouse provided by the present application;

FIG. 5 is a functional block diagram of a parsing module of a rights authentication device in a rights authentication system of a mirrored warehouse provided by the present application;

FIG. 6 is a functional block diagram of a token processing module of a token server in a rights authentication system of a mirrored warehouse provided by the present application.

Detailed ways

The present application is directed to the current image permission management requirement, and the authentication program is deployed in the mirror warehouse of the cloud management area, and the token server of the cloud management area is designated by the mirror warehouse to provide authentication services for the user to access the private Docker image warehouse and its image. Whenever the mirroring warehouse receives a request for access to the image by a user of an available area, instructs the available area client to send the user information, the accessed mirror information, and the access action to the token of the cloud management area through the proxy server of the available area. The server, the token server determines whether to grant the user the requested access rights based on the user information.

In order to make the objects, technical solutions, and advantages of the present application more clear and clear, the present application will be further described in detail below with reference to the accompanying drawings. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

Please refer to FIG. 1 , which is a flowchart of a preferred embodiment of a method for authenticating a mirrored warehouse provided by the present application. As shown in FIG. 1 , the following steps are performed on the authority authentication method of the mirror warehouse in the preferred embodiment of the present application:

S10. When the access to the Docker image repository is denied by the proxy server, receiving the unauthorized error information returned by the mirrored warehouse, where the mirrored warehouse is deployed in the cloud management area, and the response header of the unauthorized error information includes the authentication method prompt information. .

In this embodiment, the mirrored warehouse is a unique mirrored warehouse set in the cloud management area, and is not a mirrored warehouse of an available area. All the private Docker images are stored in the mirrored warehouse of the cloud management area, and each available area can be mirrored. The warehouse initiates an access request. When the client uses the command to log in to the Docker image repository, push the docker image, and pull the docker image, the docker client process sends a request to the mirror repository through the proxy server.

When the image repository identifies the client as the first access, it returns an unauthorized error message to the client, and prompts the client authentication method in the file header of the authorization error message, prompting the client to go to the token server of the cloud management area. Get the token.

In this application, only one set of mirror libraries is set in the cloud management area, so the authentication of the mirror is the same for all the clients in the available area, so the consistency of the system is maintained.

S20. Parse the unauthorized error information, generate a rights authentication request according to the authentication method prompt information, and send the permission authentication request to the proxy server, where the proxy server sends the rights authentication request to the token server for rights authentication, where the proxy server is deployed in Within the Availability Zone, the token server is deployed in the cloud management zone.

The client receives the unauthorized error message, first parses the unauthorized error information to obtain the authentication method prompt information, and then requests the token from the token server according to the prompt of the authentication method. Please refer to FIG. 2 , which is a flowchart of a preferred embodiment of step S20 in the method for authenticating the mirrored warehouse provided by the present application.

As shown in FIG. 2, the step S20 includes:

S21: Parsing the unauthorized error information, and obtaining an authentication error message in the response header of the unauthorized error information;

S22: Generate permission authentication request information by using user authentication information and requesting a mirrored content range according to the prompt of the authentication method prompt information;

S23. Send the rights authentication request information to the proxy server, and send, by the proxy server, the rights authentication request to the token server for rights authentication.

In step S22, when the rights authentication request information is generated, the user authentication information is encrypted by the docker client process according to the authentication method prompt information, placed in the request header of the https request, and the requested mirror content range is placed in the request of the https request. In the parameter, the authority authentication request information is generated based on the request header and the request parameter of the https request.

In this embodiment, the authentication information includes a user name and a password. In the specific implementation, the authentication process information of the user is first encrypted by the docker client process according to the prompt returned by the mirroring repository, and then placed in https (Hypertext) Transfer Protocol over Secure Socket Layer, which is a security-oriented HTTP channel, which is simply a secure version of HTTP) AUTHORIZATIONHeader (authorization header) of the request, and the scope of the image content requested by the user is placed in the request parameter of the https request, and sent to the proxy server through the domain name. The proxy authentication work is handled by the proxy server by the proxy server.

Each of the available areas is deployed with a set of proxy servers, which are Nginx proxy servers. The clients of each available area send the permission authentication request to the token server of the cloud management area through the proxy server set in the area. The domain name, certificate, and key of the proxy server in the Availability Zone are the same, so the consistency of the system is guaranteed.

All clients in all available areas in this application have the same mirror service and image authentication service. Only the centralized management area has a set of image libraries and authentication servers. Only the cloud management area needs to deploy mirrored warehouses and token servers. Only need to deploy the proxy server, which saves the deployment cost; the mirrored warehouse only needs one configuration, and the authentication service address in the response header of the first request returning the 401 response is specified as the authentication service domain name of the DNS resolution of each region, and then All areas can be used to make expansion, configuration and maintenance easier; moreover, the token server can be connected to other systems to extend the docking of other user information systems, which provides the possibility of integrating users of other systems.

Preferably, the method for the client to send the permission authentication request to the token server through the proxy server is specifically: the client accesses the proxy server through the domain name, and the proxy server performs the secure transport layer protocol authentication according to the domain name input by the client, and passes the verification. After receiving the client's data access request and sending it to the token server of the cloud zone, due to the domain name of the proxy server of each Availability Zone. The certificate and key are the same, so the consistency of the system is guaranteed.

S30. Receive a token returned by the token server in the cloud management area, and carry the token to send an access request to the mirror warehouse.

In the specific implementation, after the docker client process gets the token, it takes the token to request the same mirror content from the mirror warehouse again. After the token is received by the mirrored warehouse, the token is parsed to determine whether to release or block the user's request.

In a preferred embodiment, after the step S23 and before the step S30, the method further includes:

In this embodiment, after the client uploads the rights authentication request information to the proxy server, the proxy server performs the following steps: performing security transport layer protocol authentication according to the domain name input by the client, and receiving the data access request of the client after the verification is passed. Send it to the token server in the cloud zone. The proxy server verifies that when the domain name is entered incorrectly, it returns the domain name error message to the client, prompting the client to re-enter the domain name.

Preferably, after the cloud server area token server receives the rights authentication request information, the token server of the cloud management area performs the following actions:

Parsing the authority authentication request information by the token server, and verifying the user authentication information;

When the user authentication passes, it is determined according to the scope of the requested mirror content whether the client can access the mirrored content of the request. The error token is returned when the user authentication fails, and the client is not authorized to access the mirror repository.

When the client can access the requested mirrored content, the token is generated and returned to the client according to the user authentication information and the requested mirrored content range. When the user authentication information is verified, but the client cannot access the specified image content, an error message is generated and returned to the docker client process, indicating that the client does not have permission to access the content of the request.

S40. Receive an image returned by the mirror warehouse.

Before step S40, the pull mirror and the push image of the present application further include: the mirror warehouse receives the token, parses and verifies the token, and returns a mirror to the client when the verification passes.

In order to facilitate a better understanding of the privilege authentication method of the mirror warehouse, an application embodiment is described below to describe the privilege authentication method of the mirror warehouse of the present application in detail:

The method for authenticating the image warehouse provided by this application embodiment includes:

The first step, the client of the Availability Zone uses docker login, docker push, docker pull When the command is waited for, the docker client process of the client in the available area issues a request to the mirror warehouse of the cloud management area;

In the second step, after receiving the request, the mirror warehouse of the cloud management area returns an unauthorized error message to the client of the requesting available area, where the response header of the unauthorized error information includes a method for prompting the client authentication;

The third step, the docker client process of the available area encrypts the user's authentication information according to the prompt and puts it in https. The AUTHORIZATION header of the request, and the content range requested by the user is placed in the request parameter and sent to the proxy server of the Availability Zone;

The fourth step, the proxy server of the available area performs the secure transport layer protocol authentication according to the domain name input by the client, and receives the data access request of the client after the verification is passed and sends the data access request to the token server of the cloud management area;

In the fifth step, the token server of the cloud management area parses and verifies the user authentication token and the scope of the request mirror content, and sends the corresponding token to the client of the available area by verifying the corresponding token;

Step 6: After obtaining the token, the docker client process of the available area requests the same content to the mirror warehouse of the cloud management area with the token again;

In the seventh step, after the token warehouse of the cloud management area obtains the token, the token is parsed and verified, and the docker client process returns the corresponding image when the verification is passed.

The present application further provides a rights authentication system for a mirrored warehouse, as shown in FIG. 3, the rights authentication system includes a plurality of available areas, and each of the available areas includes rights authentication. Device 1 and proxy server 2, which can be considered as a Docker client for accessing the mirror repository and receiving unauthorized error information returned by the mirror repository when the access mirror repository is rejected, The response header of the unauthorized error message includes authentication method prompt information; and is used for parsing the unauthorized error information, and generates a rights authentication request according to the authentication method prompt information and sends it to the proxy server; and receiving the token server to return The token; and carrying the token to send an access request to the mirror repository; and receiving the image returned by the mirror repository. The rights authentication device referred to in the present application may be divided into one or more modules, which refers to a series of computer program instruction segments capable of performing a specific function, which is more suitable for describing the authority authentication program of the image warehouse than the program. The execution process in the Docker client. The following description divides the rights authentication device into modules to introduce its functions.

As shown in FIG. 3 and FIG. 4, the authority authentication device 1 includes an access module 11 for accessing a mirror warehouse;

The receiving module 12 is configured to receive the unauthorized error information returned by the mirror warehouse when the access mirror warehouse is rejected, and the response header of the unauthorized error information includes the authentication method prompt information;

The parsing module 13 is configured to parse the unauthorized error information, and generate a rights authentication request according to the authentication method prompt information and send the same to the proxy server;

The receiving module 12 is further configured to receive a token returned by the token server;

The authority authentication requesting module 14 is configured to carry the token to send an access request to the mirror warehouse;

The receiving module 12 is further configured to receive a mirror returned by the mirror warehouse.

The proxy server 2 is configured to send a rights authentication request to the token server of the cloud management area. In specific implementation, the proxy server is specifically configured to perform security transport layer protocol authentication according to the domain name input by the client, and receive the authentication after the verification is passed. The client's data access request is sent to the token server in the cloud zone.

Referring to FIG. 3 and FIG. 5 together, in a specific implementation, the parsing module 13 includes:

The parsing unit 131 is configured to parse the unauthorized error information, and the response header for obtaining the unauthorized error information includes the authentication method prompt information;

The request information generating unit 132 is configured to generate the authority authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information;

The sending unit 133 is configured to send the rights authentication request information to the proxy server, and the proxy server sends the rights authentication request to the token server for rights authentication.

The request information generating unit 132 is specifically configured to encrypt the user authentication information according to the authentication method prompt information, put it in the request header of the https request, and place the requested mirror content range in the request parameter of the https request, based on the request parameter. The request header and request parameters of the https request generate permission authentication request information.

Referring to FIG. 3, the authority authentication system of the mirror warehouse of the present application further includes a token server 3 disposed in the cloud management area, where the token server is configured to parse the authority authentication request information and verify user authentication information; When the user authentication is passed, it is determined whether the client can access the requested mirrored content according to the requested mirror content range; and when the client can access the mirrored content of the request, the token is generated according to the user authentication information and the requested mirrored content range. Return to the client. The token server referred to in this application can also be divided into one or more modules, which are a series of computer program instructions that are capable of performing a particular function, and are more suitable than the program to describe the execution process. The following description divides the token server into modules to introduce its functions.

Referring to FIG. 3 and FIG. 6 together, in a specific implementation, the token server 3 includes:

The verification module 31 is configured to parse the authority authentication request information, and verify user authentication information;

The determining module 32 is configured to determine, according to the scope of the mirrored content of the request, whether the client can access the mirrored content of the request when the user passes the authentication;

The token processing module 33 is configured to: when the client can access the requested mirrored content, generate a token according to the user authentication information and the requested mirrored content range, and return the token to the client.

The number of the token servers is one, and the token server is not required to be set in each available area, so that each time the authority authentication is performed, the API of the cloud management area needs to be called to authenticate the user's domain account, thereby avoiding resources. Waste, after using the proxy server, because the maintenance of the Nginx proxy server is much less difficult than the maintenance of the token server, the maintenance cost of the system is reduced, and only one token server of the cloud management area needs to be maintained.

Referring to FIG. 3, the rights authentication system of the mirrored warehouse of the present application further includes a mirrored warehouse 4 for receiving the token, parsing and verifying the token, and returning the image to the client when the verification is passed.

The number of mirrored warehouses is only one, so the authentication of the mirror is the same for all clients, maintaining system consistency.

In summary, the present application improves the security of the image by granting the authority authentication to the third party for verification, according to the request token issuance authority, and by setting the token server in the cloud management area, it is no longer necessary to set the reference in each available area. The right component avoids the need to call the cloud management area API to authenticate the user's domain account every time the authority authentication is performed, thereby avoiding waste of resources. After using the proxy server, the maintenance of the proxy server is much less difficult than the self-research authentication. Component, so you only need to maintain a token server in the cloud zone.

The present application also provides a rights authentication device for a mirrored warehouse, the rights authentication device including a processor, a memory, and a rights authentication program stored on the memory and executable by the processor, the rights authentication program When executed by the processor, the steps of the rights authentication method as described above are implemented.

For the method that is implemented when the rights authentication program is executed, refer to various embodiments of the rights authentication method of the present application, and details are not described herein again.

The present application also provides a storage medium storing a rights authentication program, and when the rights authentication program is executed by the processor, implementing the steps of the rights authentication method as described above.

Certainly, those skilled in the art can understand that all or part of the processes in the foregoing embodiments can be implemented by a computer program to instruct related hardware (such as a processor, a controller, etc.), and the program can be stored in one. In a computer readable storage medium, the program, when executed, may include the processes of the various method embodiments as described above. The storage medium described therein may be a memory, a magnetic disk, an optical disk, or the like.

It should be understood that the application of the present application is not limited to the above-described examples, and those skilled in the art can make modifications and changes in accordance with the above description, all of which are within the scope of the appended claims.

Claims

A privilege authentication method for a mirrored warehouse, wherein the privilege authentication method includes the following steps:

When the access to the Docker image repository is denied by the proxy server, the unauthorized error information returned by the mirrored warehouse is received, wherein the mirrored warehouse is deployed in the cloud management area, and the response header of the unauthorized error information includes the authentication method prompt information;

Parsing the unauthorized error information, generating a rights authentication request according to the authentication method prompt information, and sending the permission authentication request to the proxy server, where the proxy server sends the rights authentication request to the token server for rights authentication, where the proxy server is deployed in the available area The token server is deployed in the cloud management area;

Receiving a token returned by the token server in the cloud management area, and carrying the token to send an access request to the mirror warehouse;

Receive the image returned by the mirror repository.
The authority authentication method of the image warehouse according to claim 1, wherein the parsing the unauthorized error information, generating a rights authentication request according to the authentication method prompt information, and transmitting the content authentication request to the proxy server, and the proxy server requests the authority authentication The steps sent to the token server for permission authentication include:

Parsing the unauthorized error information, and obtaining an authentication error prompt message in the response header for obtaining the unauthorized error information;

Prompting the authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information;

The authority authentication request information is sent to the proxy server, and the proxy server sends the authority authentication request to the token server for authority authentication.
The method for authenticating the image warehouse according to claim 2, wherein the step of generating the authority authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information comprises:

The user authentication information is encrypted according to the authentication method prompt information, placed in the request header of the https request, and the requested mirror content range is placed in the request parameter of the https request, and the permission authentication request is generated based on the request header and the request parameter of the https request. information.
The authority authentication method of the image warehouse according to claim 2, wherein after the step of transmitting the authority authentication request information to the proxy server and transmitting the authority authentication request to the token server for authority authentication, the cloud is received Before the step of the token returned by the token server in the pipeline and carrying the token to send an access request to the mirror warehouse, the rights authentication method further includes:

The proxy server performs secure transport layer protocol authentication according to the domain name entered by the client, and receives the data access request of the client after the verification is passed and sends it to the token server of the cloud management area;

The token server of the cloud management area parses the authority authentication request information, and verifies the user authentication information;

When the user authentication is passed, it is determined according to the scope of the requested mirror content whether the client can access the mirrored content of the request;

When the client can access the requested mirrored content, the token is generated and returned to the client according to the user authentication information and the requested mirrored content range.
The method for authenticating a mirrored warehouse according to claim 1, wherein after receiving the token returned by the token server in the cloud management zone and carrying the token to send an access request to the mirrored warehouse, the receiving mirrored warehouse returns Before the mirroring step, it also includes:

The mirror repository receives the token, parses and verifies the token, and returns a mirror to the client when the verification passes.
A permission authentication system for a mirror warehouse, comprising: a plurality of available zones, each of which is provided with a rights authentication device and a proxy server,

The rights authentication device is configured to access the Docker image repository, and receive the unauthorized error information returned by the mirror warehouse when the access mirror warehouse is rejected, and the response header of the unauthorized error information includes the authentication method prompt information; And parsing the unauthorized error information, and generating a rights authentication request according to the authentication method prompt information and sending it to the proxy server; and receiving the token returned by the token server; and carrying the token to send the access to the mirror warehouse Request; and receive the image returned by the mirror repository;

The proxy server is configured to send a rights authentication request to a token server of the cloud management area.
The authority authentication system of the mirror warehouse according to claim 6, further comprising a token server disposed in the cloud management area, the token server configured to parse the authority authentication request information, and verify user authentication information; When the user authentication is passed, it is determined whether the client can access the requested mirrored content according to the requested mirror content range; and when the client can access the requested mirrored content, the token is returned according to the user authentication information and the requested mirrored content range. To the client.
The authority authentication system of the mirror warehouse according to claim 7, wherein the proxy server is further configured to perform secure transport layer protocol authentication according to the domain name input by the client, and receive the data access request of the client after the verification is passed and Send to the token server in the cloud zone.
The authority authentication system of the mirror warehouse according to claim 7, wherein the number of the token servers is one.
The authority authentication system of the mirror warehouse according to claim 6, further comprising a mirror warehouse disposed in the cloud management area, the image warehouse being configured to receive the token, parse and verify the token, and when the verification is passed , return the image to the client.
A rights authentication device for mirroring a warehouse, wherein the rights authentication device includes a processor, a memory, and a rights authentication program stored on the memory and executable by the processor, the rights authentication program being When the processor executes, the following steps are implemented:

When the access to the Docker image repository is denied by the proxy server, the unauthorized error information returned by the mirrored warehouse is received, wherein the mirrored warehouse is deployed in the cloud management area, and the response header of the unauthorized error information includes the authentication method prompt information;

Parsing the unauthorized error information, generating a rights authentication request according to the authentication method prompt information, and sending the permission authentication request to the proxy server, where the proxy server sends the rights authentication request to the token server for rights authentication, where the proxy server is deployed in the available area The token server is deployed in the cloud management area;

Receiving a token returned by the token server in the cloud management area, and carrying the token to send an access request to the mirror warehouse;

Receive the image returned by the mirror repository.
The authority authentication device of the mirror warehouse according to claim 11, wherein the parsing the unauthorized error information, generating a rights authentication request according to the authentication method prompt information, and transmitting the permission authentication request to the proxy server, and the proxy server requests the authority authentication The steps sent to the token server for permission authentication include:

Parsing the unauthorized error information, and obtaining an authentication error prompt message in the response header for obtaining the unauthorized error information;

Prompting the authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information;

The authority authentication request information is sent to the proxy server, and the proxy server sends the authority authentication request to the token server for authority authentication.
The authorization authentication device of the mirrored warehouse according to claim 12, wherein the step of generating the authority authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information comprises:

The user authentication information is encrypted according to the authentication method prompt information, placed in the request header of the https request, and the requested mirror content range is placed in the request parameter of the https request, and the permission authentication request is generated based on the request header and the request parameter of the https request. information.
A storage medium, wherein the storage medium stores a rights authentication program, and when the rights authentication program is executed by a processor, the following steps are implemented:

When the access to the Docker image repository is denied by the proxy server, the unauthorized error information returned by the mirrored warehouse is received, wherein the mirrored warehouse is deployed in the cloud management area, and the response header of the unauthorized error information includes the authentication method prompt information;

Parsing the unauthorized error information, generating a rights authentication request according to the authentication method prompt information, and sending the permission authentication request to the proxy server, where the proxy server sends the rights authentication request to the token server for rights authentication, where the proxy server is deployed in the available area The token server is deployed in the cloud management area;

Receiving a token returned by the token server in the cloud management area, and carrying the token to send an access request to the mirror warehouse;

Receive the image returned by the mirror repository.
The storage medium according to claim 14, wherein said parsing said unauthorized error information, generating a rights authentication request according to the authentication method prompt information and transmitting it to a proxy server, and transmitting, by the proxy server, a rights authentication request to the token The steps for the server to perform the rights authentication include:

Parsing the unauthorized error information, and obtaining an authentication error prompt message in the response header for obtaining the unauthorized error information;

Prompting the authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information;

The authority authentication request information is sent to the proxy server, and the proxy server sends the authority authentication request to the token server for authority authentication.
The storage medium according to claim 15, wherein the step of generating the authority authentication request information by using the user authentication information and requesting the mirrored content range according to the prompt of the authentication method prompt information comprises:

The user authentication information is encrypted according to the authentication method prompt information, placed in the request header of the https request, and the requested mirror content range is placed in the request parameter of the https request, and the permission authentication request is generated based on the request header and the request parameter of the https request. information.