RegistryAuthentication fails to fall back to PulpRemoteUserAuthentication if no authorization header exists

[ianballou]

Version
I believe any version of pulp-container that supports container push (for me, specifically 2.16.3)

Describe the bug
The following auth settings are set:

REMOTE_USER_ENVIRON_NAME = 'HTTP_REMOTE_USER'
AUTHENTICATION_BACKENDS = ['pulpcore.app.authentication.PulpNoCreateRemoteUserBackend']

REST_FRAMEWORK__DEFAULT_AUTHENTICATION_CLASSES = (
    'rest_framework.authentication.SessionAuthentication',
    'pulpcore.app.authentication.PulpRemoteUserAuthentication'
)
TOKEN_AUTH_DISABLED=True

When trying to push container content (like blobs) to Pulp, authentication always fails even if REMOTE_USER is correctly set to 'admin'.

It's caused by the following:

pulp_container/pulp_container/app/token_verification.py

Lines 82 to 88 in ef0a194

	try:
	return super().authenticate(request)
	except AuthenticationFailed:
	if self.PULP_AUTHENTICATION_CLASS in self.AUTH_CLASSES:
	return RemoteUserRegistryAuthentication().authenticate(request)
	else:
	raise

If there is no auth header, or if it doesn't have "Bearer ..." in it, super().authenticate(request) returns None instead of throwing AuthenticationFailed. This in turn causes the AnonymousUser to be used instead of admin.

The rules for returning None vs throwing AuthenticationFailed are here: https://github.com/encode/django-rest-framework/blob/085b7e166ba80aa973645e5249b441f2dbdc0c96/rest_framework/authentication.py#L66-L67

To Reproduce
Try to push container content, like blobs with the settings above. HTTP_REMOTE_USER should be set to 'admin'.

Expected behavior
Auth is successful

Additional context
This was tested on a Katello development install with in-development container push code. Ping me if anything should be tested on my environment.

[ianballou]

Example headers:

{'Host': 'centos8-katello-devel.example.com', 'Remote-User': 'admin', 'X-Forwarded-Host': 'centos8-katello-devel.example.com', 'Ssl-Client-Verify': 'SUCCESS', 'Accept': '', 'User-Agent': 'rest-client/2.1.0 (linux x86_64) ruby/2.7.8p225', 'Via': '1.1 centos8-katello-devel.example.com', 'X-Forwarded-For': '192.168.122.147', 'Connection': 'Keep-Alive', 'X-Forwarded-Server': 'centos8-katello-devel.example.com', 'X-Forwarded-Proto': 'https', 'Ssl-Client-S-Dn': 'CN=centos8-katello-devel.example.com,OU=PUPPET,O=FOREMAN,ST=North Carolina,C=US', 'Authorization': 'OAuth oauth_nonce="83uUxZN8iMwMkmB9AEscNb85YRzcq4NjT5WuTlTto", oauth_signature="InlN1ZJlQ1W1EuNetAfk8Gr%2FPkc%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1711576760", oauth_version="1.0"', 'Accept-Encoding': 'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'Ssl-Client-Cert': '-----BEGIN CERTIFICATE----- <REDACTED> -----END CERTIFICATE----- '}