Docker Registry 3 auth with Keycloak 26 #44435

ch-zacmo · 2025-11-24T14:37:48Z

ch-zacmo
Nov 24, 2025

Hi,

I am trying to integrate Docker Registry (Distribution v3) using the docker-v2 protocol with Keycloak (version 26.4.5).
I have configured the registry to use token-based authentication, pointing to:

https://auth.mydomain.xyz/realms/SSO/protocol/docker-v2/auth

On the Keycloak side, I created a client with protocol docker-v2.
However, in the Client Scopes -> docker-registry-dedicated section, the only mapper available in the UI is:

docker-v2-allow-all-mapper

I added this mapper, and Keycloak does return a token when queried manually (via curl).
But during an actual docker login I have a 401 (Keycloak events say login OK)
or docker push, Docker sends two scope parameters because Keycloak is not generating any scope in the WWW-Authenticate challenge or in the token itself.

As a result, Keycloak answers 400 Bad Request

Registry Auth Config

auth:
  token:
    autoredirect: false
    realm: https://auth.mydomain.xyz/realms/sso/protocol/docker-v2/auth
    service: docker-registry
    issuer: https://auth.mydomain.xyz/realms/sso
    #rootcertbundle: /certs/pubkey.pem
    jwks: /jwks/jwks.json
    signing_algorithms:
      - RS256

Does someone has a working stack ? If I can't manage repository scope, it's not a problem, but I need at least to be able to authenticate to push/pull

Thank you!

Navigation Menu

Repository navigation

Docker Registry 3 auth with Keycloak 26 #44435

Uh oh!

{{title}}

Uh oh!

Replies: 0 comments

Select a reply

Uh oh!

Docker Registry 3 auth with Keycloak 26 #44435

Uh oh!

ch-zacmo Nov 24, 2025

Registry Auth Config

Replies: 0 comments

ch-zacmo
Nov 24, 2025