Skip to content

Support JOB-TOKEN authentication header for generic packages

Kristupas Antanavicius requested to merge gitlab-community/gitlab:allow-auth-config-job-token-and-basic-auth into master

What does this MR do and why?

This MR adds authentication support using both JOB-TOKEN and Basic Authentication headers for Generic packages. Related issues:

Screenshots or screen recordings

NA

⚗ How to set up and validate locally

1️⃣ With CI

  1. Create a project with the following .gitlab-ci.yml file: 
    image: curlimages/curl:latest

stages:
  - upload
  - download

upload:
  stage: upload
  script:
    - 'echo "bananas!" > file.txt'
    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" --upload-file ./file.txt "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt"'

download_using_header:
  stage: download
  script:
    - 'curl --header "JOB-TOKEN: $CI_JOB_TOKEN" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt"'

download_using_job_token_query_param:
  stage: download
  script:
    - 'curl "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt?job_token=${CI_JOB_TOKEN}"'

download_using_runner_token_query_param:
  stage: download
  script:
    - 'curl "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt?token=${CI_JOB_TOKEN}"'

download_using_basic_auth:
  stage: download
  script:
    - 'curl --user "gitlab-ci-token:${CI_JOB_TOKEN}" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/packages/generic/my_package/0.0.1/file.txt"'
  2. Commit and watch the runner do its thing 🍿

2️⃣ with $ curl

  • Have a PAT ready.
  • Run the previous scenario to at least publish the generic package to the project's generic registry.

Let's check with the header:

$ curl --header "PRIVATE-TOKEN: <pat>" "http://gdk.test:8000/api/v4/projects/<project_id>/packages/generic/my_package/0.0.1/file.txt"
bananas!

Let's check with basic auth (inline form):

$ curl "http://<username>:<pat>@gdk.test:8000/api/v4/projects/<project_id>/packages/generic/my_package/0.0.1/file.txt" 
bananas!

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by David Fernandez

Merge request reports