feat(sessions): add support for remote redis session store (#3345)

Description
====================
zot currently stores session cookies in memory or in a local directory.
For cases where the session cookies should be independent of the
instance where they were created such as multiple instances of zot, or a
fully stateless zot instance, there is a need to support a remote
session storage.
This change adds support for using Redis and Redis-compatible services as a
remote session driver as well as introduces a new configuration option
for it.

What has changed
=======================
- New config added under Auth config to specify configuration for
  the session driver.
- Examples README updated with details of the new Auth config.
- The config supports only 2 drivers in this change - local and redis
- Using the local driver is backwards compatible and behaves the same
  way that zot currently works for local session storage.
- Omitting this config does not result in an error. In this case, zot
  behaves as it normally does for local session storage.
- When configured, zot can use redis for persisting cookie
  information for zot UI.
- The cookie in the store is deleted on logout or after the max
  expiry time for the cookie.
- Configuration for the redis session driver accepts the same configuration
  values as that of the remote meta cache.
- A separate connection is established for the session driver. An
  existing connection for meta cache will not be re-used for the
  session driver.
- A key prefix is configurable for the redis session driver. The value will be
  converted into a string for use. If no value is provided, a default
  prefix of "zotsession" will be used.
- Redis sessions does not support hash key or encryption in this change.
- New BATS test added to verify zot behavior with Redis session store.
- Github workflow updated to install valkey-tools dependency for BATS.

Signed-off-by: Vishwas Rajashekar <dev@vrajashkr.com>

pkg/api/authn_test.go

@@ -15,11 +15,14 @@ import (
 	"testing"
 	"time"
 
+	"github.com/alicebob/miniredis/v2"
 	guuid "github.com/gofrs/uuid"
+	godigest "github.com/opencontainers/go-digest"
 	"github.com/project-zot/mockoidc"
 	. "github.com/smartystreets/goconvey/convey"
 	"gopkg.in/resty.v1"
 
+	zerr "zotregistry.dev/zot/errors"
 	"zotregistry.dev/zot/pkg/api"
 	"zotregistry.dev/zot/pkg/api/config"
 	"zotregistry.dev/zot/pkg/api/constants"
@@ -934,45 +937,65 @@ func TestCookiestoreCleanup(t *testing.T) {
 	log := log.NewTestLogger()
 	metrics := monitoring.NewMetricsServer(true, log)
 
-	Convey("Test cookiestore cleanup works", t, func() {
-		taskScheduler := scheduler.NewScheduler(config.New(), metrics, log)
-		taskScheduler.RateLimit = 50 * time.Millisecond
-		taskScheduler.RunScheduler()
+	authCfgTestCases := []struct {
+		name string
+		cfg  config.AuthConfig
+	}{
+		{
+			"empty Auth config",
+			config.AuthConfig{},
+		},
+		{
+			"local session driver",
+			config.AuthConfig{
+				SessionDriver: map[string]any{
+					"name": "local",
+				},
+			},
+		},
+	}
 
-		rootDir := t.TempDir()
+	for _, testCase := range authCfgTestCases {
+		Convey("Test cookiestore cleanup works with "+testCase.name, t, func() {
+			taskScheduler := scheduler.NewScheduler(config.New(), metrics, log)
+			taskScheduler.RateLimit = 50 * time.Millisecond
+			taskScheduler.RunScheduler()
 
-		err := os.MkdirAll(path.Join(rootDir, "_sessions"), storageConstants.DefaultDirPerms)
-		So(err, ShouldBeNil)
+			rootDir := t.TempDir()
 
-		sessionPath := path.Join(rootDir, "_sessions", "session_1234")
+			err := os.MkdirAll(path.Join(rootDir, "_sessions"), storageConstants.DefaultDirPerms)
+			So(err, ShouldBeNil)
 
-		err = os.WriteFile(sessionPath, []byte("session"), storageConstants.DefaultFilePerms)
-		So(err, ShouldBeNil)
+			sessionPath := path.Join(rootDir, "_sessions", "session_1234")
 
-		changeTime := time.Now().Add(-4 * time.Hour)
+			err = os.WriteFile(sessionPath, []byte("session"), storageConstants.DefaultFilePerms)
+			So(err, ShouldBeNil)
 
-		err = os.Chtimes(sessionPath, changeTime, changeTime)
-		So(err, ShouldBeNil)
+			changeTime := time.Now().Add(-4 * time.Hour)
 
-		imgStore := local.NewImageStore(rootDir, false, false, log, metrics, nil, nil, nil, nil)
+			err = os.Chtimes(sessionPath, changeTime, changeTime)
+			So(err, ShouldBeNil)
 
-		storeController := storage.StoreController{
-			DefaultStore: imgStore,
-		}
+			imgStore := local.NewImageStore(rootDir, false, false, log, metrics, nil, nil, nil, nil)
 
-		cookieStore, err := api.NewCookieStore(storeController, nil, nil)
-		So(err, ShouldBeNil)
+			storeController := storage.StoreController{
+				DefaultStore: imgStore,
+			}
 
-		cookieStore.RunSessionCleaner(taskScheduler)
+			cookieStore, err := api.NewCookieStore(&testCase.cfg, storeController, log)
+			So(err, ShouldBeNil)
 
-		time.Sleep(2 * time.Second)
+			cookieStore.RunSessionCleaner(taskScheduler)
 
-		taskScheduler.Shutdown()
+			time.Sleep(2 * time.Second)
 
-		// make sure session is removed
-		_, err = os.Stat(sessionPath)
-		So(err, ShouldNotBeNil)
-	})
+			taskScheduler.Shutdown()
+
+			// make sure session is removed
+			_, err = os.Stat(sessionPath)
+			So(err, ShouldNotBeNil)
+		})
+	}
 
 	Convey("Test cookiestore cleanup without permissions on rootDir", t, func() {
 		taskScheduler := scheduler.NewScheduler(config.New(), metrics, log)
@@ -995,7 +1018,11 @@ func TestCookiestoreCleanup(t *testing.T) {
 			DefaultStore: imgStore,
 		}
 
-		cookieStore, err := api.NewCookieStore(storeController, []byte("secret"), nil)
+		authCfg := config.AuthConfig{
+			SessionHashKey: []byte("secret"),
+		}
+
+		cookieStore, err := api.NewCookieStore(&authCfg, storeController, log)
 		So(err, ShouldBeNil)
 
 		err = os.Chmod(rootDir, 0o000)
@@ -1085,6 +1112,113 @@ func TestCookiestoreCleanup(t *testing.T) {
 	})
 }
 
+func TestRedisCookieStore(t *testing.T) {
+	log := log.Logger{}
+
+	testRedis := miniredis.RunT(t)
+
+	storeController := storage.StoreController{
+		DefaultStore: &mocks.MockedImageStore{
+			GetImageManifestFn: func(repo string, reference string) ([]byte, godigest.Digest, string, error) {
+				return []byte{}, "", "", zerr.ErrRepoBadVersion
+			},
+		},
+	}
+
+	testCases := []struct {
+		testName       string
+		shouldErrBeNil bool
+		expectedErrStr string
+		inputCfg       *config.AuthConfig
+	}{
+		{
+			"Cookie store creation should not fail if the driver is local",
+			true,
+			"",
+			&config.AuthConfig{
+				SessionDriver: map[string]any{
+					"name": "local",
+				},
+			},
+		},
+		{
+			"Cookie store creation should fail if the driver is unsupported",
+			false,
+			"invalid server config: sessiondriver unknowndriver not supported",
+			&config.AuthConfig{
+				SessionDriver: map[string]any{
+					"name": "unknowndriver",
+				},
+			},
+		},
+		{
+			"Cookie store creation should not fail if the keyPrefix for Redis is not a string",
+			true,
+			"",
+			&config.AuthConfig{
+				SessionDriver: map[string]any{
+					"name":      "redis",
+					"keyprefix": 8,
+					"url":       "redis://" + testRedis.Addr(),
+				},
+			},
+		},
+		{
+			"Cookie store creation should not fail if the SessionDriver Config is nil",
+			true,
+			"",
+			&config.AuthConfig{},
+		},
+		{
+			"Cookie store creation and use should succeed with valid configuration",
+			true,
+			"",
+			&config.AuthConfig{
+				SessionDriver: map[string]any{
+					"name": "redis",
+					"url":  "redis://" + testRedis.Addr(),
+				},
+			},
+		},
+		{
+			"Cookie store creation should fail if the url for Redis is incorrect",
+			false,
+			"dial tcp: lookup unknown on 127.0.0.53:53: server misbehaving",
+			&config.AuthConfig{
+				SessionDriver: map[string]any{
+					"name": "redis",
+					"url":  "redis://unknown:1000",
+				},
+			},
+		},
+		{
+			"Cookie store creation should fail if the url for Redis has an invalid value",
+			false,
+			"invalid server config: cachedriver map[name:redis url:%!s(int=100)] has invalid value for url",
+			&config.AuthConfig{
+				SessionDriver: map[string]any{
+					"name": "redis",
+					"url":  100,
+				},
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		Convey(testCase.testName, t, func() {
+			cookieStore, err := api.NewCookieStore(testCase.inputCfg, storeController, log)
+			if testCase.shouldErrBeNil {
+				So(err, ShouldBeNil)
+				So(cookieStore, ShouldNotBeNil)
+			} else {
+				So(err, ShouldNotBeNil)
+				So(err.Error(), ShouldEqual, testCase.expectedErrStr)
+				So(cookieStore, ShouldBeNil)
+			}
+		})
+	}
+}
+
 type mockUUIDGenerator struct {
 	guuid.Generator
 	succeedAttempts int

pkg/api/config/config.go

@@ -75,8 +75,9 @@ type AuthConfig struct {
 	OpenID            *OpenIDConfig
 	APIKey            bool
 	SessionKeysFile   string
-	SessionHashKey    []byte `json:"-"`
-	SessionEncryptKey []byte `json:"-"`
+	SessionHashKey    []byte         `json:"-"`
+	SessionEncryptKey []byte         `json:"-"`
+	SessionDriver     map[string]any `mapstructure:",omitempty"`
 }
 
 type BearerConfig struct {

pkg/api/config/redis/redis.go

@@ -81,7 +81,7 @@ func ParseRedisUniversalOptions(redisConfig map[string]interface{}, //nolint: go
 		opts.Addrs = val
 	}
 
-	if val, ok := getString(redisConfig, "client_name", false, log); ok {
+	if val, ok := GetString(redisConfig, "client_name", false, log); ok {
 		opts.ClientName = val
 	}
 
@@ -93,19 +93,19 @@ func ParseRedisUniversalOptions(redisConfig map[string]interface{}, //nolint: go
 		opts.Protocol = val
 	}
 
-	if val, ok := getString(redisConfig, "username", false, log); ok {
+	if val, ok := GetString(redisConfig, "username", false, log); ok {
 		opts.Username = val
 	}
 
-	if val, ok := getString(redisConfig, "password", true, log); ok {
+	if val, ok := GetString(redisConfig, "password", true, log); ok {
 		opts.Password = val
 	}
 
-	if val, ok := getString(redisConfig, "sentinel_username", false, log); ok {
+	if val, ok := GetString(redisConfig, "sentinel_username", false, log); ok {
 		opts.SentinelUsername = val
 	}
 
-	if val, ok := getString(redisConfig, "sentinel_password", true, log); ok {
+	if val, ok := GetString(redisConfig, "sentinel_password", true, log); ok {
 		opts.SentinelPassword = val
 	}
 
@@ -185,7 +185,7 @@ func ParseRedisUniversalOptions(redisConfig map[string]interface{}, //nolint: go
 		opts.RouteRandomly = val
 	}
 
-	if val, ok := getString(redisConfig, "master_name", false, log); ok {
+	if val, ok := GetString(redisConfig, "master_name", false, log); ok {
 		opts.MasterName = val
 	}
 
@@ -193,7 +193,7 @@ func ParseRedisUniversalOptions(redisConfig map[string]interface{}, //nolint: go
 		opts.DisableIdentity = val
 	}
 
-	if val, ok := getString(redisConfig, "identity_suffix", false, log); ok {
+	if val, ok := GetString(redisConfig, "identity_suffix", false, log); ok {
 		opts.IdentitySuffix = val
 	}
 
@@ -246,7 +246,7 @@ func getInt(dict map[string]interface{}, key string, log log.Logger) (int, bool)
 	return ret, true
 }
 
-func getString(dict map[string]interface{}, key string, hideValue bool, log log.Logger) (string, bool) {
+func GetString(dict map[string]interface{}, key string, hideValue bool, log log.Logger) (string, bool) {
 	value, ok := dict[key]
 	if !ok {
 		return "", false

pkg/api/controller.go

@@ -324,8 +324,7 @@ func (c *Controller) initCookieStore() error {
 			c.Config.HTTP.Auth.SessionHashKey = securecookie.GenerateRandomKey(64) //nolint: gomnd
 		}
 
-		cookieStore, err := NewCookieStore(c.StoreController, c.Config.HTTP.Auth.SessionHashKey,
-			c.Config.HTTP.Auth.SessionEncryptKey)
+		cookieStore, err := NewCookieStore(c.Config.HTTP.Auth, c.StoreController, c.Log)
 		if err != nil {
 			return err
 		}

pkg/api/controller_test.go

@@ -4952,6 +4952,417 @@ func TestOpenIDMiddleware(t *testing.T) {
 	}
 }
 
+func TestOpenIDMiddlewareWithRedisSessionDriver(t *testing.T) {
+	port := test.GetFreePort()
+	baseURL := test.GetBaseURL(port)
+	defaultVal := true
+
+	conf := config.New()
+	conf.HTTP.Port = port
+
+	testCases := []struct {
+		testCaseName string
+		address      string
+		externalURL  string
+	}{
+		{
+			address:      "0.0.0.0",
+			externalURL:  "http://" + net.JoinHostPort(conf.HTTP.Address, conf.HTTP.Port),
+			testCaseName: "with ExternalURL provided in config",
+		},
+		{
+			address:      "127.0.0.1",
+			externalURL:  "",
+			testCaseName: "without ExternalURL provided in config",
+		},
+		{
+			address:      "127.0.0.1",
+			externalURL:  "",
+			testCaseName: "without ExternalURL provided in config and session keys for cookies",
+		},
+	}
+
+	// need a username different than ldap one, to test both logic
+	htpasswdUsername, seedUser := test.GenerateRandomString()
+	htpasswdPassword, seedPass := test.GenerateRandomString()
+	htpasswdPath := test.MakeHtpasswdFileFromString(test.GetCredString(htpasswdUsername, htpasswdPassword))
+
+	defer os.Remove(htpasswdPath)
+
+	ldapServer := newTestLDAPServer()
+	port = test.GetFreePort()
+
+	ldapPort, err := strconv.Atoi(port)
+	if err != nil {
+		panic(err)
+	}
+
+	ldapServer.Start(ldapPort)
+	defer ldapServer.Stop()
+
+	mockOIDCServer, err := authutils.MockOIDCRun()
+	if err != nil {
+		panic(err)
+	}
+
+	defer func() {
+		err := mockOIDCServer.Shutdown()
+		if err != nil {
+			panic(err)
+		}
+	}()
+
+	mockOIDCConfig := mockOIDCServer.Config()
+	conf.HTTP.Auth = &config.AuthConfig{
+		HTPasswd: config.AuthHTPasswd{
+			Path: htpasswdPath,
+		},
+		LDAP: (&config.LDAPConfig{
+			Insecure: true,
+			Address:  LDAPAddress,
+
+			Port:          ldapPort,
+			BaseDN:        LDAPBaseDN,
+			UserAttribute: "uid",
+		}).SetBindDN(LDAPBindDN).SetBindPassword(LDAPBindPassword),
+		OpenID: &config.OpenIDConfig{
+			Providers: map[string]config.OpenIDProviderConfig{
+				"oidc": {
+					ClientID:     mockOIDCConfig.ClientID,
+					ClientSecret: mockOIDCConfig.ClientSecret,
+					KeyPath:      "",
+					Issuer:       mockOIDCConfig.Issuer,
+					Scopes:       []string{"openid", "email"},
+				},
+				// just for the constructor coverage
+				"github": {
+					ClientID:     mockOIDCConfig.ClientID,
+					ClientSecret: mockOIDCConfig.ClientSecret,
+					KeyPath:      "",
+					Issuer:       mockOIDCConfig.Issuer,
+					Scopes:       []string{"openid", "email"},
+				},
+			},
+		},
+	}
+
+	searchConfig := &extconf.SearchConfig{
+		BaseConfig: extconf.BaseConfig{Enable: &defaultVal},
+	}
+
+	// UI is enabled because we also want to test access on the mgmt route
+	uiConfig := &extconf.UIConfig{
+		BaseConfig: extconf.BaseConfig{Enable: &defaultVal},
+	}
+
+	conf.Extensions = &extconf.ExtensionConfig{
+		Search: searchConfig,
+		UI:     uiConfig,
+	}
+
+	ctlr := api.NewController(conf)
+	ctlr.Log.Info().Int64("seedUser", seedUser).Int64("seedPass", seedPass).Msg("random seed for username & password")
+
+	for _, testcase := range testCases {
+		t.Run(testcase.testCaseName, func(t *testing.T) {
+			Convey("make controller", t, func() {
+				dir := t.TempDir()
+
+				ctlr.Config.Storage.RootDirectory = dir
+				ctlr.Config.HTTP.ExternalURL = testcase.externalURL
+				ctlr.Config.HTTP.Address = testcase.address
+
+				// Setup redis test server and config to use remote session store
+				testRedis := miniredis.RunT(t)
+
+				conf.HTTP.Auth.SessionDriver = map[string]any{
+					"name": "redis",
+					"url":  "redis://" + testRedis.Addr(),
+				}
+
+				cm := test.NewControllerManager(ctlr)
+
+				cm.StartServer()
+
+				defer cm.StopServer()
+				test.WaitTillServerReady(baseURL)
+
+				Convey("browser client requests", func() {
+					Convey("login with no provider supplied", func() {
+						client := resty.New()
+						client.SetRedirectPolicy(test.CustomRedirectPolicy(20))
+						// first login user
+						resp, err := client.R().
+							SetHeader(constants.SessionClientHeaderName, constants.SessionClientHeaderValue).
+							SetQueryParam("provider", "unknown").
+							Get(baseURL + constants.LoginPath)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusBadRequest)
+					})
+
+					//nolint: dupl
+					Convey("make sure sessions are not used without UI header value", func() {
+						So(len(testRedis.Keys()), ShouldEqual, 0)
+
+						client := resty.New()
+
+						// without header should not create session
+						resp, err := client.R().SetBasicAuth(htpasswdUsername, htpasswdPassword).Get(baseURL + "/v2/")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						So(len(testRedis.Keys()), ShouldEqual, 0)
+
+						client.SetHeader(constants.SessionClientHeaderName, constants.SessionClientHeaderValue)
+
+						resp, err = client.R().SetBasicAuth(htpasswdUsername, htpasswdPassword).Get(baseURL + "/v2/")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						So(len(testRedis.Keys()), ShouldEqual, 1)
+
+						// set cookies
+						client.SetCookies(resp.Cookies())
+
+						// should get same cookie
+						resp, err = client.R().SetBasicAuth(htpasswdUsername, htpasswdPassword).Get(baseURL + "/v2/")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						So(len(testRedis.Keys()), ShouldEqual, 1)
+
+						resp, err = client.R().SetBasicAuth(htpasswdUsername, htpasswdPassword).
+							Get(baseURL + constants.FullMgmt)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						client.SetCookies(resp.Cookies())
+
+						// call endpoint with session, without credentials, (added to client after previous request)
+						resp, err = client.R().
+							Get(baseURL + "/v2/_catalog")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						resp, err = client.R().SetBasicAuth(htpasswdUsername, htpasswdPassword).Get(baseURL + "/v2/")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						So(len(testRedis.Keys()), ShouldEqual, 1)
+					})
+
+					Convey("login with openid and get catalog with session", func() {
+						client := resty.New()
+						client.SetRedirectPolicy(test.CustomRedirectPolicy(20))
+						client.SetHeader(constants.SessionClientHeaderName, constants.SessionClientHeaderValue)
+
+						Convey("with callback_ui value provided", func() {
+							// first login user
+							resp, err := client.R().
+								SetQueryParam("provider", "oidc").
+								SetQueryParam("callback_ui", baseURL+"/v2/").
+								Get(baseURL + constants.LoginPath)
+							So(err, ShouldBeNil)
+							So(resp, ShouldNotBeNil)
+							So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+						})
+
+						// first login user
+						resp, err := client.R().
+							SetQueryParam("provider", "oidc").
+							Get(baseURL + constants.LoginPath)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusCreated)
+
+						client.SetCookies(resp.Cookies())
+
+						// call endpoint with session (added to client after previous request)
+						resp, err = client.R().
+							Get(baseURL + "/v2/_catalog")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						// logout with options method for coverage
+						resp, err = client.R().
+							Options(baseURL + constants.LogoutPath)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+
+						// logout user
+						resp, err = client.R().
+							Post(baseURL + constants.LogoutPath)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						// calling endpoint should fail with unauthorized access
+						resp, err = client.R().
+							Get(baseURL + "/v2/_catalog")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusUnauthorized)
+					})
+
+					//nolint: dupl
+					Convey("login with basic auth(htpasswd) and get catalog with session", func() {
+						client := resty.New()
+						client.SetHeader(constants.SessionClientHeaderName, constants.SessionClientHeaderValue)
+
+						// without creds, should get access error
+						resp, err := client.R().Get(baseURL + "/v2/")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusUnauthorized)
+
+						var e apiErr.Error
+
+						err = json.Unmarshal(resp.Body(), &e)
+						So(err, ShouldBeNil)
+
+						// first login user
+						// with creds, should get expected status code
+						resp, err = client.R().SetBasicAuth(htpasswdUsername, htpasswdPassword).Get(baseURL)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						resp, err = client.R().SetBasicAuth(htpasswdUsername, htpasswdPassword).Get(baseURL + "/v2/")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						resp, err = client.R().SetBasicAuth(htpasswdUsername, htpasswdPassword).
+							Get(baseURL + constants.FullMgmt)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						client.SetCookies(resp.Cookies())
+
+						// call endpoint with session, without credentials, (added to client after previous request)
+						resp, err = client.R().
+							Get(baseURL + "/v2/_catalog")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						resp, err = client.R().
+							Get(baseURL + constants.FullMgmt)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						// logout user
+						resp, err = client.R().
+							Post(baseURL + constants.LogoutPath)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						// calling endpoint should fail with unauthorized access
+						resp, err = client.R().
+							Get(baseURL + "/v2/_catalog")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusUnauthorized)
+					})
+
+					//nolint: dupl
+					Convey("login with ldap and get catalog", func() {
+						client := resty.New()
+						client.SetHeader(constants.SessionClientHeaderName, constants.SessionClientHeaderValue)
+
+						// without creds, should get access error
+						resp, err := client.R().Get(baseURL + "/v2/")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusUnauthorized)
+
+						var e apiErr.Error
+
+						err = json.Unmarshal(resp.Body(), &e)
+						So(err, ShouldBeNil)
+
+						// first login user
+						// with creds, should get expected status code
+						resp, err = client.R().SetBasicAuth(username, password).Get(baseURL)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						resp, err = client.R().SetBasicAuth(username, password).Get(baseURL + "/v2/")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						resp, err = client.R().SetBasicAuth(username, password).
+							Get(baseURL + constants.FullMgmt)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						client.SetCookies(resp.Cookies())
+
+						// call endpoint with session, without credentials, (added to client after previous request)
+						resp, err = client.R().
+							Get(baseURL + "/v2/_catalog")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						resp, err = client.R().
+							Get(baseURL + constants.FullMgmt)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						// logout user
+						resp, err = client.R().
+							Post(baseURL + constants.LogoutPath)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						// calling endpoint should fail with unauthorized access
+						resp, err = client.R().
+							Get(baseURL + "/v2/_catalog")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusUnauthorized)
+					})
+
+					Convey("unauthenticated catalog request", func() {
+						client := resty.New()
+
+						// mgmt should work both unauthenticated and authenticated
+						resp, err := client.R().
+							Get(baseURL + constants.FullMgmt)
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusOK)
+
+						// call endpoint without session
+						resp, err = client.R().
+							Get(baseURL + "/v2/_catalog")
+						So(err, ShouldBeNil)
+						So(resp, ShouldNotBeNil)
+						So(resp.StatusCode(), ShouldEqual, http.StatusUnauthorized)
+					})
+				})
+			})
+		})
+	}
+}
+
 func TestIsOpenIDEnabled(t *testing.T) {
 	Convey("make oidc server", t, func() {
 		port := test.GetFreePort()

pkg/api/cookiestore.go

@@ -12,7 +12,12 @@ import (
 	"time"
 
 	"github.com/gorilla/sessions"
+	"github.com/rbcervilla/redisstore/v9"
 
+	"zotregistry.dev/zot/errors"
+	"zotregistry.dev/zot/pkg/api/config"
+	rediscfg "zotregistry.dev/zot/pkg/api/config/redis"
+	"zotregistry.dev/zot/pkg/log"
 	"zotregistry.dev/zot/pkg/scheduler"
 	"zotregistry.dev/zot/pkg/storage"
 	storageConstants "zotregistry.dev/zot/pkg/storage/constants"
@@ -36,7 +41,11 @@ func (c *CookieStore) RunSessionCleaner(sch *scheduler.Scheduler) {
 	}
 }
 
-func NewCookieStore(storeController storage.StoreController, hashKey, encryptKey []byte) (*CookieStore, error) {
+func NewCookieStore(
+	authCfg *config.AuthConfig,
+	storeController storage.StoreController,
+	log log.Logger,
+) (*CookieStore, error) {
 	// To store custom types in our cookies
 	// we must first register them using gob.Register
 	gob.Register(map[string]interface{}{})
@@ -47,10 +56,109 @@ func NewCookieStore(storeController storage.StoreController, hashKey, encryptKey
 
 	var needsCleanup bool
 
+	if authCfg.SessionDriver == nil {
+		// If the session driver is not configured, then
+		// behave in the usual way for file system cookie store and memory cookie store.
+		createdStore, returnedSessionsDir, doesStoreNeedCleanup, err := localSessionStoreInit(
+			storeController,
+			authCfg.SessionHashKey,
+			authCfg.SessionEncryptKey,
+		)
+		if err != nil {
+			return &CookieStore{}, err
+		}
+
+		store = createdStore
+		sessionsDir = returnedSessionsDir
+		needsCleanup = doesStoreNeedCleanup
+	} else {
+		switch authCfg.SessionDriver["name"] {
+		case storageConstants.RedisDriverName:
+			{
+				prefix, ok := rediscfg.GetString(authCfg.SessionDriver, "keyprefix", false, log)
+				if !ok {
+					prefix = "zotsession"
+				}
+
+				// The redisstore library code uses a colon to separate the prefix
+				// and the actual key and is expected to be part of the prefix argument.
+				// ref: https://github.com/rbcervilla/redisstore/blob/v9.0.0/redisstore.go#L44
+				// This adds a colon to the prefix only if it is not empty.
+				if prefix != "" {
+					prefix += ":"
+				}
+
+				client, err := rediscfg.GetRedisClient(authCfg.SessionDriver, log)
+				if err != nil {
+					return nil, err
+				}
+
+				redisStore, err := redisstore.NewRedisStore(context.Background(), client)
+				if err != nil {
+					return nil, err
+				}
+
+				redisStore.KeyPrefix(prefix)
+				redisStore.Options(sessions.Options{
+					MaxAge: cookiesMaxAge,
+					Path:   "/",
+				})
+
+				store = redisStore
+			}
+		case storageConstants.LocalStorageDriverName:
+			{
+				// This behaves the same as if there was no sessionDriver config.
+				// It is also the same behaviour prior to supporting this config.
+				// This allows for a backwards compatible migration path for upgrades.
+				createdStore, sessDir, cleanupReq, err := localSessionStoreInit(
+					storeController,
+					authCfg.SessionHashKey,
+					authCfg.SessionEncryptKey,
+				)
+				if err != nil {
+					return &CookieStore{}, err
+				}
+
+				store = createdStore
+				sessionsDir = sessDir
+				needsCleanup = cleanupReq
+			}
+		default:
+			return nil, fmt.Errorf(
+				"%w: sessiondriver %s not supported",
+				errors.ErrBadConfig,
+				authCfg.SessionDriver["name"],
+			)
+		}
+	}
+
+	return &CookieStore{
+		Store:        store,
+		rootDir:      sessionsDir,
+		needsCleanup: needsCleanup,
+	}, nil
+}
+
+// Handles creation and init of a local session store.
+// This can be either in memory or on the local file system.
+// Returns a session Store, root directory for the sessions if applicable,
+// a boolean indicating whether clean up is required, and an error.
+func localSessionStoreInit(
+	storeController storage.StoreController,
+	hashKey,
+	encryptKey []byte,
+) (sessions.Store, string, bool, error) {
+	var store sessions.Store
+
+	var sessionsDir string
+
+	var needsCleanup bool
+
 	if storeController.DefaultStore.Name() == storageConstants.LocalStorageDriverName {
 		sessionsDir = path.Join(storeController.DefaultStore.RootDir(), "_sessions")
 		if err := os.MkdirAll(sessionsDir, storageConstants.DefaultDirPerms); err != nil {
-			return &CookieStore{}, err
+			return &CookieStore{}, "", false, err
 		}
 
 		localStore := sessions.NewFilesystemStore(sessionsDir, hashKey, encryptKey)
@@ -67,11 +175,7 @@ func NewCookieStore(storeController storage.StoreController, hashKey, encryptKey
 		store = memStore
 	}
 
-	return &CookieStore{
-		Store:        store,
-		rootDir:      sessionsDir,
-		needsCleanup: needsCleanup,
-	}, nil
+	return store, sessionsDir, needsCleanup, nil
 }
 
 func IsExpiredSession(dirEntry fs.DirEntry) bool {