[Feat]: OIDC workload authentication through HTTP Basic

[peter-facko]

Is your feature request related to a problem? Please describe.

My use case: use a regular Python package manager tool such as uv and storage Python packages in zot.

Based on these discussions:

• Support Bearer Authentication for Package Registry astral-sh/uv#18541
• Bearer Authentication AllexVeldman/pyoci#419

who does the zot community feel is the responsible party in supporting this use case?

Describe the solution you'd like

Add a configuration where OIDC workload identity tokens could be passed through HTTP Basic.

Describe alternatives you've considered

• use another registry
• use curl instead of a normal package manager

Additional context

No response

[rchincha]

@peter-facko is basic auth even supported for oidc? I would imagine even most RFCs would have an opinion about this.

[peter-facko]

@rchincha, I don't think you are supposed to send an OIDC token through Basic, but that's the only thing that Python supports right now.

astral-sh/uv#18541 (comment):

2. Separately, GitLab should allow you to pass your OAuth2 access token via basic authentication, in addition to the normal (more idiomatic) bearer authentication. This would be maximally compatible with what all Python installers currently do, and wouldn't require any additional changes to uv. To my understanding this is what some other index services (like Google Artifact Registry) do with their OAuth2 access tokens (they do oauth2accesstoken:<token> as the pair).

[rchincha]

#4077

would this work for you? courtesy GH copilot.

[peter-facko]

I looked at the Copilot comments and the code and it seems it should work. Thank you! I didn't test it though.

[rchincha]

| I didn't test it though.

Pls. do and let us know. We can add this to the next release.

[rchincha]

#4090