Improve Notation authentication experience

[FeynmanZhou]

What is the areas you would like to add the new feature to?

Notation CLI

Is your feature request related to a problem?

Notation has a command notation login to enable authentication with registries. It should allow users to input a username and password from the prompted response when using notation login sample.registry.com.

What solution do you propose?

The expected experience is as follows:

notation login sample.registry.com
Username: xxx
Password: 
Login Succeeded

What alternatives have you considered?

None

Any additional context?

No response

[FeynmanZhou]

I also detected another problem when using notation login with the flag --password-stdin, it requires users to input the password explicitly but without any correct return. This should be a bug.

cc @JeyJeyGao

[JeyJeyGao]

I also detected another problem when using notation login with the flag --password-stdin, it requires users to input the password explicitly but without any correct return. This should be a bug.

cc @JeyJeyGao

Confirmed the bug.

[duffney]

@FeynmanZhou is it possible to use docker login to authenticate notation to a remote registry? Being able to share that docker login credentials would safe the user from having to authenticate to the same registry twice. Once for the container push and a second time for the signing.

[ningziwen]

docker login or the login in other tools basically store the credentials in a local file by default. For Docker, it is ~/.docker/config.json.

I like the idea of sharing credentials to prevent users authenticating twice. Instead of sharing crednetial only for Docker, how about adding a credential path feature to let users point any config.json locally?

Users can simply put "DockerConfig" keyword in "credStore" in notation config, then notation will use $DOCKER_CONFIG/config.json as the plain test credential store. ($DOCKER_CONFIG is ~/.docker by default but can be overriden by users)

notation login and notation logout still work against whatever the docker-style config.json users point to.

WDYT? I could try to implement this if this sounds good. @FeynmanZhou

[FeynmanZhou]

@ningziwen Thanks for your interest. Yes, I agree with @duffney and your proposal of sharing and reusing the Docker credential store within Notation authentication. If users log in to a registry with docker login, Notation will be able to reuse ~/.docker/config.json to authenticate with that registry without additional configuration. I believe it will simplify the authentication experience.

As this issue is tracking an authentication UX bug in notation login, shall I create a new issue for implementing this proposal above? Then you can pick it up if you are interested.

[ningziwen]

@FeynmanZhou Having a new issue sounds good to me. Thanks!

[ningziwen]

Opened a draft PR. I have a question about tests. Appreciated for any help.

[toddysm]

Will the proposed implementation cover improvements in the error messages returned by the CLI as described in notaryproject/notaryproject.dev#156?

[FeynmanZhou]

@toddysm Yes. The error message improvement will be covered by #600.