better basic auth support

Author: BaptisteCentreon

docs/admin/guides/auth/workload_identity.md

@@ -17,8 +17,7 @@ and you want its permissions scoped to specific repositories without long-lived
 
 ## How it works
 
-On each request the token is read from the `Authorization` header,
-either as a `Bearer` token or as the password of a `Basic` header (the way `docker login` sends a token).
+On each request the token is read from the `Authorization: Bearer` header.
 The `iss` claim selects a configured provider,
 the signature is verified against the provider's JWKS,
 and `iss`, `aud` and `exp` are checked.
@@ -28,7 +27,6 @@ A token that matches no rule is rejected with a 401.
 ## Enabling
 
 Add the authentication class to `DEFAULT_AUTHENTICATION_CLASSES`,
-before `BasicAuthentication` so the `docker login` path reaches it,
 then populate `WORKLOAD_IDENTITY`:
 
 ```python title="settings.py"

pulpcore/app/checks.py

@@ -123,3 +123,33 @@ def check_artifact_checksums(app_configs, **kwargs):
         )
 
     return messages
+
+
+@register(deploy=True)
+def workload_identity_reserved_username(app_configs, **kwargs):
+    from pulpcore.app.workload_identity import config
+
+    messages = []
+    if not config.config():
+        return messages
+
+    username = config.basic_username()
+    try:
+        from django.contrib.auth import get_user_model
+
+        collides = get_user_model().objects.filter(username=username).exists()
+    except Exception:
+        return messages
+
+    if collides:
+        messages.append(
+            CheckWarning(
+                f"The WORKLOAD_IDENTITY basic_auth_username '{username}' is also a database user. "
+                "A token presented with this username over Basic auth is validated as a workload "
+                "identity token, not as that user's password. Set basic_auth_username to a name "
+                "that is not a real user to avoid ambiguity.",
+                id="pulpcore.W006",
+            )
+        )
+
+    return messages

pulpcore/app/workload_identity/authentication.py

@@ -1,7 +1,8 @@
 """DRF authentication that validates a third-party OIDC token against its provider's JWKS.
 
-The token arrives as a ``Bearer`` token or as the password in a ``Basic`` header (``docker login``).
-On success its claims map to grants and a stateless ``WorkloadIdentityPrincipal`` is returned.
+The token arrives as a ``Bearer`` token, or as the password of a ``Basic`` header whose username
+is the reserved workload-identity name. On success its claims map to grants and a stateless
+``WorkloadIdentityPrincipal`` is returned.
 """
 
 import base64
@@ -28,7 +29,12 @@ class WorkloadIdentityAuthentication(BaseAuthentication):
     """
 
     def _get_token(self, request):
-        """Return the token from the Authorization header (Bearer, or Basic password), or None."""
+        """Return the token from the Authorization header, or None.
+
+        Accepts a ``Bearer`` token, or a token carried as the password of a ``Basic`` header whose
+        username is the reserved workload-identity name. Any other ``Basic`` header is left for the
+        regular authenticators.
+        """
         header = request.META.get("HTTP_AUTHORIZATION", "")
         parts = header.split()
         if len(parts) != 2:
@@ -42,9 +48,9 @@ def _get_token(self, request):
                 decoded = base64.b64decode(value).decode("utf-8")
             except (binascii.Error, ValueError, UnicodeDecodeError):
                 return None
-            if ":" not in decoded:
+            username, sep, password = decoded.partition(":")
+            if not sep or username != config.basic_username():
                 return None
-            _, _, password = decoded.partition(":")
             return password
         return None
 

pulpcore/app/workload_identity/config.py

@@ -18,6 +18,11 @@ def providers():
     return config().get("providers", {}) or {}
 
 
+def basic_username():
+    """The reserved username that flags a token carried in the ``Basic`` password field."""
+    return config().get("basic_auth_username", "workload-identity")
+
+
 def provider_for_issuer(issuer):
     """Return the provider entry whose ``issuer`` matches, or ``None``."""
     for entry in providers().values():

pulpcore/app/workload_identity/principal.py

@@ -55,5 +55,5 @@ def get_group_permissions(self, obj=None):
         return set()
 
     def __str__(self):
-        """The username, or ``"oidc-principal"`` when it is empty."""
-        return self.username or "oidc-principal"
+        """The username, or ``"workload-identity"`` when it is empty."""
+        return self.username or "workload-identity"