distribution: Private Registry "invalid authorization credential" appears, but everything works fine.

We use a Private Docker Registry and everything works fine, but we get this error message everytime we push a image into the Registry:

time="2019-01-15T05:50:24.629888749Z" level=warning msg="error authorizing context: basic authentication challenge for realm "My Docker Registry Realm": invalid authorization credential" go.version=go1.11.2 http.request.host="my-registry.my.domain:443" http.request.id=e57cef36-9230-4b8a-8ad8-b2c2a1860a6f http.request.method=GET http.request.remoteaddr="XXX.XXX.XXX.XXX:42626" http.request.uri="/v2/" http.request.useragent="docker/18.09.0 go/go1.10.4 git-commit/4d60db4 kernel/3.10.0-957.1.3.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.0 \(linux\))"

This is how we configure our Registry:

version: "2"
services:
  registry:
    image: registry:latest
    restart: always
    ports:
      - 443:5000
    volumes:
      - ./certs:/certs
      - ./auth:/auth
      - ./data:/var/lib/registry
    environment:
      - REGISTRY_AUTH_HTPASSWD_PATH=/auth/htpasswd
      - REGISTRY_AUTH=htpasswd
      - REGISTRY_AUTH_HTPASSWD_REALM=My Docker Registry Realm
      - REGISTRY_HTTP_TLS_CERTIFICATE=/certs/my-registry.my.domain.crt
      - REGISTRY_HTTP_TLS_KEY=/certs/my-registry.my.domain.key
      - REGISTRY_STORAGE_DELETE_ENABLED=true
      - REGISTRY_LOG_LEVEL=warn
      - REGISTRY_HTTP_HOST=https://my-registry.my.domain:443

We tried it with different Docker Versions but everytime we get this error message. We are not using a proxy between the Client and Server

About this issue

Original URL
State: closed
Created 5 years ago
Reactions: 18
Comments: 18 (5 by maintainers)

Commits related to this issue

fix: registry no longer support MD5 According to this following bug report, you must use a salted hash, otherwise, authentication will not work! see: https://github.com/distribution/distribution/is... — committed to deunz/k3s.rocks by deunz 7 months ago

Most upvoted comments

Probably, it help someone… I had the same issue when added password with htpasswd without -B key. After adding password with -B key it actually worked. I suppose MD5 password hashing support was dropped.

+13

Vovcharaa on Jan 19, 2021

@caervs Thanks for the fast reply. I logged in through the same host as REGISTRY_HTTP_HOST, when I push an Image into the Registry it gets pushed and it works. The error message appears, but nothing fails… And I used htpasswd -Bbn admin password > /auth/htpasswd to create a htpasswd. The Registry is working fine and we have no problems, only the error message disturbs me. Im not sure if this is a false report or false configuration…

GEownt on Jan 16, 2019

I’m experiencing this as well, and to be honest it’s pretty worrying that it’s logging an error message claiming that authentication failed but just allowing the image to be downloaded anyway.

nicbarker on May 27, 2019

@GEownt you’ve configured the registry to authenticate with basic auth so you’re going to need to log in to it first from your docker client.

docker login my-registry.my.domain:443

Before doing that you should make sure you’ve created credentials on the registry side (e.g. by execing into the registry container and running htpasswd -Bbn admin password > /auth/htpasswd)

EDIT: ~~Oh I see login is successful but layer uploads are not. Investigating now.~~ Also, please ensure you’re logging in through the same host you have set as REGISTRY_HTTP_HOST

caervs on Jan 15, 2019

@ThinhVu please stop using profanities in your comments. I appreciate you didn’t direct it at anyone but let’s keep the issues on this repository civil

Edited

ThinhVu on Jul 11, 2023

@ThinhVu please stop using profanities in your comments. I appreciate you didn’t direct it at anyone but let’s keep the issues on this repository civil

milosgajdos on Jul 11, 2023

Probably, it help someone… I had the same issue when added password with htpasswd without -B key. After adding password with -B key it actually worked. I suppose MD5 password hashing support was dropped.

Nice!! It worked. The registry official image only works with bcrypt.

Fellipe-A on Feb 23, 2021

@adam2k I reverted to registry version 2.0 instead of 2.7. Worked for me. No Issues so far. Since its a private registry it doesnt really matter. You may have different considerations for your production environment though.

codebaard on Sep 3, 2020

Just saying: same error here. Can push as well.

codebaard on Aug 12, 2020