"error authorizing context: insufficient scope" happened while docker push

[henry2005]

crane v1.0.6

when use docker push command, got a error.(but docker login success)

`10.27.228.201 - - [10/Jan/2017:14:47:01 +0800] "POST /v2/lzhtomcat/blobs/uploads/ HTTP/1.0" 401 198 "" "docker/1.12.5 go/go1.6.4 git-commit/7392c3b kernel/3.10.0-327.22.2.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/1.12.5 \(linux\))"

time="2017-01-10T14:47:01.320579578+08:00" level=debug msg="authorizing request" go.version=go1.5.3 http.request.host="hz09:5000" http.request.id=9ab9c314-b11a-4eca-92a8-7606843254bc http.request.method=POST http.request.remoteaddr="10.27.228.201:49490" http.request.uri="/v2/lzhtomcat/blobs/uploads/" http.request.useragent="docker/1.12.5 go/go1.6.4 git-commit/7392c3b kernel/3.10.0-327.22.2.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/1.12.5 \(linux\))" instance.id=1fea0bf7-0ab0-4d3e-9288-5130ec90887b service=registry vars.name=lzhtomcat version=v2.3.0

time="2017-01-10T14:47:01.32086714+08:00" level=warning msg="error authorizing context: insufficient scope" go.version=go1.5.3 http.request.host="hz09:5000" http.request.id=9ab9c314-b11a-4eca-92a8-7606843254bc http.request.method=POST http.request.remoteaddr="10.27.228.201:49490" http.request.uri="/v2/lzhtomcat/blobs/uploads/" http.request.useragent="docker/1.12.5 go/go1.6.4 git-commit/7392c3b kernel/3.10.0-327.22.2.el7.x86_64 os/linux arch/amd64 UpstreamClient(Docker-Client/1.12.5 \(linux\))" instance.id=1fea0bf7-0ab0-4d3e-9288-5130ec90887b service=registry vars.name=lzhtomcat version=v2.3.0 `

my config

registry(default config)

`auth:

token:

issuer: dataman-inc

realm: http://10.28.35.201:5013/registry/v1/token

rootcertbundle: /etc/registry/root.crt

service: token-service`

crane(default config)

`CRANE_ADDR=0.0.0.0:5013
CRANE_SWARM_MANAGER_IP
CRANE_DOCKER_TLS_VERIFY=false
CRANE_DOCKER_ENTRY_PORT=2375
CRANE_DOCKER_API_VERSION=1.24
CRANE_DOCKER_CERT_PATH=null

CRANE_DB_DSN=XXXXXXXX
CRANE_DB_DRIVER=mysql

CRANE_FEATURE_FLAGS=registry,account,catalog,search,registryauth

CRANE_REGISTRY_PRIVATE_KEY_PATH=./private_key.pem
CRANE_REGISTRY_ADDR=http://crane_registry:5000

CRANE_ACCOUNT_TOKEN_STORE=default
CRANE_ACCOUNT_AUTHENTICATOR=default
CRANE_ACCOUNT_EMAIL_DEFAULT=admin@admin.com
CRANE_ACCOUNT_PASSWORD_DEFAULT=XXXXX

CRANE_SEARCH_LOAD_DATA_INTERVAL=1`

[henry2005]

on the crane console web, i config the image namespace "token-service"

registry auth

token-service / rugu / passwd

[vitan]

Paste the other containers(registry, blackmamba, crane, mysql) log also please.

[xiaods]

found the registry is not create namespace, so you can't correctly push image successful.

[henry2005]

how to fix this problem

[xiaods]

@henry2005 we will fix it asap.

[xiaods]

@henry2005 because the registry service is updated, the api have been changed, so i need refactor code to fix it.

[xiaods]

found the root cause, will fix it asap today.

src/plugins/registry/util.go +155

154 func (registry *Registry) GetPermission(username, namespace, image string) string {
155 ^Ifmt.Printf("username: %s ,get registryNamespaceForEmail: %s", username, registry.registryNamespaceForEmail(username))                                                       

[cmingxu]

Reopen this, need more clarification on this.