// Convert_v1_OAuthConfig_To_config_OAuthConfig is an autogenerated conversion function.
548344
func Convert_v1_OAuthConfig_To_config_OAuthConfig(in *v1.OAuthConfig, out *config.OAuthConfig, s conversion.Scope) error {
	return autoConvert_v1_OAuthConfig_To_config_OAuthConfig(in, out, s)
}
649425
func Convert_config_ControllerConfig_To_v1_ControllerConfig(in *config.ControllerConfig, out *v1.ControllerConfig, s conversion.Scope) error {
	return autoConvert_config_ControllerConfig_To_v1_ControllerConfig(in, out, s)
}
145433
func Convert_v1_WebhookTokenAuthenticator_To_config_WebhookTokenAuthenticator(in *v1.WebhookTokenAuthenticator, out *config.WebhookTokenAuthenticator, s conversion.Scope) error {
	return autoConvert_v1_WebhookTokenAuthenticator_To_config_WebhookTokenAuthenticator(in, out, s)
}
34136
func Convert_config_RFC2307Config_To_v1_RFC2307Config(in *config.RFC2307Config, out *v1.RFC2307Config, s conversion.Scope) error {
	return autoConvert_config_RFC2307Config_To_v1_RFC2307Config(in, out, s)
}
68553
func Convert_v1_IdentityConfiguration_To_config_IdentityConfiguration(in *IdentityConfiguration, out *config.IdentityConfiguration, s conversion.Scope) error {
	return autoConvert_v1_IdentityConfiguration_To_config_IdentityConfiguration(in, out, s)
}
318844
func Convert_v1_JenkinsPipelineConfig_To_config_JenkinsPipelineConfig(in *v1.JenkinsPipelineConfig, out *config.JenkinsPipelineConfig, s conversion.Scope) error {
	return autoConvert_v1_JenkinsPipelineConfig_To_config_JenkinsPipelineConfig(in, out, s)
}
354283
func Convert_v1_OpenIDClaims_To_config_OpenIDClaims(in *v1.OpenIDClaims, out *config.OpenIDClaims, s conversion.Scope) error {
	return autoConvert_v1_OpenIDClaims_To_config_OpenIDClaims(in, out, s)
}
1071172
func Convert_auditregistration_WebhookClientConfig_To_v1alpha1_WebhookClientConfig(in *auditregistration.WebhookClientConfig, out *v1alpha1.WebhookClientConfig, s conversion.Scope) error {
	return autoConvert_auditregistration_WebhookClientConfig_To_v1alpha1_WebhookClientConfig(in, out, s)
}
711079
func Convert_config_AdmissionConfig_To_v1_AdmissionConfig(in *config.AdmissionConfig, out *v1.AdmissionConfig, s conversion.Scope) error {
	return autoConvert_config_AdmissionConfig_To_v1_AdmissionConfig(in, out, s)
}
285002
func Convert_v1_DNSConfig_To_config_DNSConfig(in *v1.DNSConfig, out *config.DNSConfig, s conversion.Scope) error {
	return autoConvert_v1_DNSConfig_To_config_DNSConfig(in, out, s)
}
155655
func Convert_v1_SessionConfig_To_config_SessionConfig(in *v1.SessionConfig, out *config.SessionConfig, s conversion.Scope) error {
	return autoConvert_v1_SessionConfig_To_config_SessionConfig(in, out, s)
}
373305
func NewOAuthServerConfig(oauthConfig osinv1.OAuthConfig, userClientConfig *rest.Config, genericConfig *genericapiserver.RecommendedConfig) (*OAuthServerConfig, error) {
	// TODO: there is probably some better way to do this
	decoder := codecs.UniversalDecoder(osinv1.GroupVersion)
	for i, idp := range oauthConfig.IdentityProviders {
		if idp.Provider.Object != nil {
			// depending on how you get here, the IDP objects may or may not be filled out
			break
		}
		idpObject, err := runtime.Decode(decoder, idp.Provider.Raw)
		if err != nil {
			return nil, err
		}
		oauthConfig.IdentityProviders[i].Provider.Object = idpObject
	}

	// this leaves the embedded OAuth server code path alone
	if genericConfig == nil {
		genericConfig = genericapiserver.NewRecommendedConfig(codecs)
	}

	genericConfig.LoopbackClientConfig = userClientConfig

	userClient, err := userclient.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}
	oauthClient, err := oauthclient.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}
	eventsClient, err := corev1.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}
	routeClient, err := routeclient.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}
	kubeClient, err := kclientset.NewForConfig(userClientConfig)
	if err != nil {
		return nil, err
	}

	bootstrapUserDataGetter := bootstrap.NewBootstrapUserDataGetter(kubeClient.CoreV1(), kubeClient.CoreV1())

	var sessionAuth session.SessionAuthenticator
	if oauthConfig.SessionConfig != nil {
		// TODO we really need to enforce HTTPS always
		secure := isHTTPS(oauthConfig.MasterPublicURL)
		auth, err := buildSessionAuth(secure, oauthConfig.SessionConfig, bootstrapUserDataGetter)
		if err != nil {
			return nil, err
		}
		sessionAuth = auth

		// session capability is the only thing required to enable the bootstrap IDP
		// we dynamically enable or disable its UI based on the backing secret
		// this must be the first IDP to make sure that it can handle basic auth challenges first
		// this mostly avoids weird cases with the allow all IDP
		oauthConfig.IdentityProviders = append(
			[]osinv1.IdentityProvider{
				{
					Name:            bootstrap.BootstrapUser, // will never conflict with other IDPs due to the :
					UseAsChallenger: true,
					UseAsLogin:      true,
					MappingMethod:   string(identitymapper.MappingMethodClaim), // irrelevant, but needs to be valid
					Provider: runtime.RawExtension{
						Object: &config.BootstrapIdentityProvider{},
					},
				},
			},
			oauthConfig.IdentityProviders...,
		)
	}

	if len(oauthConfig.IdentityProviders) == 0 {
		oauthConfig.IdentityProviders = []osinv1.IdentityProvider{
			{
				Name:            "defaultDenyAll",
				UseAsChallenger: true,
				UseAsLogin:      true,
				MappingMethod:   string(identitymapper.MappingMethodClaim),
				Provider: runtime.RawExtension{
					Object: &osinv1.DenyAllPasswordIdentityProvider{},
				},
			},
		}
	}

	ret := &OAuthServerConfig{
		GenericConfig: genericConfig,
		ExtraOAuthConfig: ExtraOAuthConfig{
			Options:                        oauthConfig,
			KubeClient:                     kubeClient,
			EventsClient:                   eventsClient.Events(""),
			RouteClient:                    routeClient,
			UserClient:                     userClient.Users(),
			IdentityClient:                 userClient.Identities(),
			UserIdentityMappingClient:      userClient.UserIdentityMappings(),
			OAuthAccessTokenClient:         oauthClient.OAuthAccessTokens(),
			OAuthAuthorizeTokenClient:      oauthClient.OAuthAuthorizeTokens(),
			OAuthClientClient:              oauthClient.OAuthClients(),
			OAuthClientAuthorizationClient: oauthClient.OAuthClientAuthorizations(),
			SessionAuth:                    sessionAuth,
			BootstrapUserDataGetter:        bootstrapUserDataGetter,
		},
	}
	genericConfig.BuildHandlerChainFunc = ret.buildHandlerChainForOAuth

	return ret, nil
}
1193980
func Convert_config_NodeAuthConfig_To_v1_NodeAuthConfig(in *config.NodeAuthConfig, out *v1.NodeAuthConfig, s conversion.Scope) error {
	return autoConvert_config_NodeAuthConfig_To_v1_NodeAuthConfig(in, out, s)
}
1310869
func Convert_config_SessionConfig_To_v1_SessionConfig(in *config.SessionConfig, out *v1.SessionConfig, s conversion.Scope) error {
	return autoConvert_config_SessionConfig_To_v1_SessionConfig(in, out, s)
}
178746
func Convert_v1_RoutingConfig_To_config_RoutingConfig(in *v1.RoutingConfig, out *config.RoutingConfig, s conversion.Scope) error {
	return autoConvert_v1_RoutingConfig_To_config_RoutingConfig(in, out, s)
}
108003
func Convert_v1_NodeAuthConfig_To_config_NodeAuthConfig(in *v1.NodeAuthConfig, out *config.NodeAuthConfig, s conversion.Scope) error {
	return autoConvert_v1_NodeAuthConfig_To_config_NodeAuthConfig(in, out, s)
}
224094
func GetAuthConfig(username, password, registry string) (types.AuthConfig, error) {
	if username != "" && password != "" && registry != "" {
		return types.AuthConfig{
			Username:      username,
			Password:      password,
			ServerAddress: registry,
		}, nil
	}

	dcfg, err := config.Load(config.Dir())
	if err != nil {
		return types.AuthConfig{}, fmt.Errorf("loading config file failed: %v", err)
	}

	// return error early if there are no auths saved
	if !dcfg.ContainsAuth() {
		// If we were passed a registry, just use that.
		if registry != "" {
			return setDefaultRegistry(types.AuthConfig{
				ServerAddress: registry,
			}), nil
		}

		// Otherwise, just use an empty auth config.
		return types.AuthConfig{}, nil
	}

	authConfigs, err := dcfg.GetAllCredentials()
	if err != nil {
		return types.AuthConfig{}, fmt.Errorf("getting credentials failed: %v", err)
	}

	// if they passed a specific registry, return those creds _if_ they exist
	if registry != "" {
		// try with the user input
		if creds, ok := authConfigs[registry]; ok {
			fixAuthConfig(&creds, registry)
			return creds, nil
		}

		// remove https:// from user input and try again
		if strings.HasPrefix(registry, "https://") {
			registryCleaned := strings.TrimPrefix(registry, "https://")
			if creds, ok := authConfigs[registryCleaned]; ok {
				fixAuthConfig(&creds, registryCleaned)
				return creds, nil
			}
		}

		// remove http:// from user input and try again
		if strings.HasPrefix(registry, "http://") {
			registryCleaned := strings.TrimPrefix(registry, "http://")
			if creds, ok := authConfigs[registryCleaned]; ok {
				fixAuthConfig(&creds, registryCleaned)
				return creds, nil
			}
		}

		// add https:// to user input and try again
		// see https://github.com/genuinetools/reg/issues/32
		if !strings.HasPrefix(registry, "https://") && !strings.HasPrefix(registry, "http://") {
			registryCleaned := "https://" + registry
			if creds, ok := authConfigs[registryCleaned]; ok {
				fixAuthConfig(&creds, registryCleaned)
				return creds, nil
			}
		}

		logrus.Debugf("Using registry %q with no authentication", registry)

		// Otherwise just use the registry with no auth.
		return setDefaultRegistry(types.AuthConfig{
			ServerAddress: registry,
		}), nil
	}

	// Just set the auth config as the first registryURL, username and password
	// found in the auth config.
	for _, creds := range authConfigs {
		fmt.Printf("No registry passed. Using registry %q\n", creds.ServerAddress)
		return creds, nil
	}

	// Don't use any authentication.
	// We should never get here.
	fmt.Println("Not using any authentication")
	return types.AuthConfig{}, nil
}