Implementing Strong Authentication and Authorization

Implementing Strong Authentication and Authorization

Registry authentication forms the first line of defense against unauthorized access. Basic authentication over HTTPS provides minimal security suitable only for development environments. Production registries require integration with enterprise identity providers through OAuth2, LDAP, or SAML. Multi-factor authentication should be mandatory for administrative access and recommended for all users.

Token-based authentication enables fine-grained access control and temporary permissions. JSON Web Tokens (JWT) encode user identity and permissions, enabling stateless authentication. Token expiration limits exposure from compromised credentials. Refresh tokens enable extended sessions without storing long-lived credentials. Proper token validation prevents forged authentication attempts.

# Example: Harbor registry configuration with OIDC authentication
authentication:
  mode: oidc_auth
  oidc:
    name: "Corporate SSO"
    endpoint: "https://sso.company.com"
    client_id: "harbor-registry"
    client_secret: "$OIDC_CLIENT_SECRET"
    scope: "openid,profile,email,groups"
    groups_claim: "groups"
    admin_group: "harbor-admins"
    auto_onboard: true
    user_claim: "email"
    verify_cert: true

# Role-based access control
rbac:
  roles:
    - name: "developer"
      permissions:
        - resource: "repository"
          action: "pull"
        - resource: "repository"
          action: "push"
        - resource: "scan"
          action: "read"
    
    - name: "security-team"
      permissions:
        - resource: "repository"
          action: "pull"
        - resource: "scan"
          action: "create"
        - resource: "scan"
          action: "read"
        - resource: "artifact"
          action: "delete"
    
    - name: "ci-system"
      permissions:
        - resource: "repository"
          action: "push"
        - resource: "tag"
          action: "create"
        - resource: "scan"
          action: "create"

# Network security
network:
  https:
    enabled: true
    certificate: "/certs/registry.crt"
    private_key: "/certs/registry.key"
    strong_ciphers: true
    min_tls_version: "1.2"

Authorization mechanisms must support repository-level permissions and tag-based access control. Role-based access control (RBAC) maps users to permissions through role assignments. Repository namespaces enable organizational separation with delegated administration. Tag immutability prevents overwrites of production images. Audit logging tracks all authorization decisions for security monitoring and compliance.