Skip to content

Include DEFAULT_AUTHENTICATION_CLASSES when token auth is disabled#2363

Open
dkliban wants to merge 1 commit into
pulp:mainfrom
dkliban:include-default-auth-classes
Open

Include DEFAULT_AUTHENTICATION_CLASSES when token auth is disabled#2363
dkliban wants to merge 1 commit into
pulp:mainfrom
dkliban:include-default-auth-classes

Conversation

@dkliban
Copy link
Copy Markdown
Member

@dkliban dkliban commented May 14, 2026

Summary

  • When TOKEN_AUTH_DISABLED=True, ContainerRegistryApiMixin.authentication_classes now includes DEFAULT_AUTHENTICATION_CLASSES alongside RegistryAuthentication
  • This allows deployments to use custom authentication backends (e.g. remote header-based auth) for container registry operations without maintaining a downstream patch
  • RegistryAuthentication remains first for backwards compatibility

Fixes #2362

Test plan

  • Existing tests pass (no behavior change for deployments not using custom auth backends)
  • Deployments with custom DEFAULT_AUTHENTICATION_CLASSES can authenticate to registry API when TOKEN_AUTH_DISABLED=True

When TOKEN_AUTH_DISABLED=True, ContainerRegistryApiMixin only used
RegistryAuthentication (Basic auth), ignoring any custom backends
configured in DEFAULT_AUTHENTICATION_CLASSES.

Now includes both RegistryAuthentication and all configured default
authentication classes, allowing deployments to use custom auth
backends alongside standard Basic auth for container registry
operations.

Fixes pulp#2362

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Include DEFAULT_AUTHENTICATION_CLASSES when token auth is disabled

1 participant