How LDAP/AD Authentication Works

Every company needs a directory where all user login data is kept. There are two popular technologies for configuring and managing such directories – Windows Active Directory (AD) and Lightweight Directory Access Protocol – that are Harbor-compatible. It means that you can use an LDAP/AD server to add new users to the Container Registry instance and manage existing accounts on the server.

Indeed, you need to set up and configure such a server before you can activate this kind of user authentication in Container Registry. How you do it, depends on your provider. You can look for instructions on the official website of the OpenLDAP project or in the Windows server official documentation.

Limitations of LDAP/AD Authentication

If you select this authentication mode, then, as a system admin, you will only be able to see a list of users in your Container Registry admin console but you won’t be able to perform any actions with them in the GUI, neither create and delete users nor change and reset their passwords. That all must be done on the LDAP or AD server. For the users, the self-registration option is not available in this mode (and you cannot enable it as an admin).

Advantages of LDAP/AD Authentication

  • If you already have an LDAP/AD server, you can onboard Container Registry users quicker.
  • You can use the same LDAP/AD server to add and manage users of more than one Container Registry instance.
  • You can create user groups and assign multiple users to projects in one leap.

LDAP User Groups

Optionally, you can create user groups to be able to assign users to projects in bulks in the Container Registry GUI.

Since an LDAP directory is a tree-like structure, it’s naturally hierarchical. Groups are a way to put entities – in our case, users – together independently of that hierarchy. One user can be a member of more than one group.

On the LDAP/AD server, you need to use the memberof attribute of the entries. If you are new to this technology, look into this tutorial that explains how to create groups on the LDAP server and add users into them.

To configure them, see Configure LDAP/AD Authentication.