registry delegated auth config

dev_guide/managing_images.adoc

@@ -523,6 +523,58 @@ $ oc secrets link builder <pull_secret_name>
 ----
 endif::openshift-origin,openshift-online,openshift-enterprise,openshift-dedicated[]
 
+[[pulling-private-registries-delegated-auth]]
+==== Pulling from Private Registries with Delegated Authentication
+
+In some cases a private registry may delegate authentication to a separate
+service. Image pull secrets must be defined for both the authentication and
+registry endpoints.
+
+[INFO]
+====
+The Red Hat Container Catalog delegates authentication to **sso.redhat.com**.
+The following procedure applies.
+====
+
+. Create a secret for the delegated authentication server.
++
+----
+$ oc secret new-dockercfg \
+    --docker-server=sso.redhat.com \
+    [email protected] \
+    --docker-password=******** \
+    --docker-email=unused \
+    redhat-connect-sso
+secret/redhat-connect-sso
+----
++
+. Create a secret for the registry.
++
+----
+$ oc secret new-dockercfg \
+    --docker-server=privateregistry.example.com \
+    [email protected] \
+    --docker-password=******** \
+    --docker-email=unused \
+    private-registry
+secret/private-registry
+----
++
+[INFO]
+====
+The Red Hat Container Catalog link:https://bugzilla.redhat.com/show_bug.cgi?id=1476330[does not accept the auto-generated dockercfg secret type].
+A generic file-based secret must be created using the generated file from a docker
+login command.
+
+----
+$ docker login registry.connect.redhat.com --username [email protected]
+Password: *************
+Login Succeeded
+$ oc secret new redhat-connect .dockerconfigjson=/root/.docker/config.json
+$ oc secrets link default redhat-connect --for=pull
+----
+====
+
 [[importing-tag-and-image-metadata]]
 == Importing Tag and Image Metadata