title: 401 "authentication required" with Harbor replication
body: <p>I have deployed a private docker registry with vmware-harbor v1.5.0. Although it could work with most functions, such as login and pull/push images, but when I try to use [administration] -> [replications], an error of "authentication required" always accurred.</p>
  
  <p><strong>following is the harbor replication error detail</strong>:</p>
  
  <blockquote>
    <p>2018-08-06T06:57:41Z [INFO] initialization completed: repository: ops/test, tags: [3.4.11], source registry: URL-<a href="http://registry.xx.com" rel="nofollow noreferrer">http://registry.xx.com</a> insecure-true, destination registry: URL-<a href="https://registry-slave.xx.com" rel="nofollow noreferrer">https://registry-slave.xx.com</a> insecure-false</p>
    
    <p>2018-08-06T06:57:41Z [WARNING] the status code is 409 when creating project ops on destination registry, try to do next step</p>
    
    <p>2018-08-06T06:57:41Z [ERROR] [job_logger.go:81]: an error occurred while pulling manifest of ops/zookeeper:3.4.11 from source registry: 401 {"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"repository","Class":"","Name":"ops/test","Action":"pull"}]}]</p>
  </blockquote>
  
  <hr>
  
  <p>As above, the UNAUTHORIZED error seems occurring due to pulling image from local, not due to the remote. In fact, the remote registry has passed the "test connection" in [administration] -> [registries] creating page.</p>
  
  <p>I wonder, is there some specified configuration should be set to use replication function? which role was used when pulling images from local?</p>
  
  <hr>
  
  <p>so I try to read harbor source code and find the error message raising point in <a href="https://github.com/vmware/harbor/blob/d1304585d330707bf9a95e2135ec87823a808a42/src/jobservice/job/impl/replication/transfer.go" rel="nofollow noreferrer">jobservice/job/impl/replication/transfer.go</a> in line 230:</p>
  
  <p><code>acceptMediaTypes := []string{schema1.MediaTypeManifest, schema2.MediaTypeManifest}
  digest, mediaType, payload, err := t.srcRegistry.PullManifest(tag, acceptMediaTypes)
  if err != nil {
      t.logger.Errorf("an error occurred while pulling manifest of %s:%s from source registry: %v",
          t.repository.name, tag, err)
      return "", nil, err
  </code></p>
  
  <p>as above code, it seems that 401 http code never be considered, the acceptMediaTypes are some http header to deal with media type, not authentication. so how harbor pulls images from local?</p>
  
  <hr>
  
  <p><strong>environment</strong>:</p>
  
  <p>linux: Red Hat Enterprise Linux Server release 7.5 (Maipo)</p>
  
  <p>harbor: v1.5.0</p>
  
  <p>docker(client and server): 17.12.1-ce</p>
  
  <hr>
  
  <p><strong>network topology</strong>:</p>
  
  <p>nginx (https:443) -> harbor (http:8082)</p>
  
  <p>nginx and harbor were both deployed on the same KVM</p>
  
  <p>"registry-test.xx.com" resolved in DNS</p>
  
  <hr>
  
  <p>I prefer to know anyone has successed to use harbor's replication function...</p>
  
  <p>So any one can give me a hand or just some tips? many thanks~</p>
  
  <hr>
  
  <p><strong>some more detail: 08-07</strong></p>
  
  <p>Try to get some wireshark info from the KVM locally</p>
  
  <pre><code>tcpdump -i any port 8082
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/JE6UE.png" rel="nofollow noreferrer">pcap during replication</a></p>
  
  <p>As shown, "/service/token" request has been sent, and got the correct token, but the following manifest request carried no anthenticate token, so it failed. so I don't know what happened to the token cache.</p>
  
  <p>Maybe I need to read more code detail from <a href="https://github.com/vmware/harbor/blob/8c6df84b86fd7c2da81edba7ceca8ea8517c27ad/src/common/utils/registry/auth/tokenauthorizer.go" rel="nofollow noreferrer">common/utils/registry/auth/tokenauthorizer.go</a></p>