How LDAP/AD Authentication Works

Every company needs a directory where all user login data is kept. There are two popular technologies for configuring and managing such directories – Windows Active Directory (AD) and Lightweight Directory Access Protocol – that are Harbor-compatible. It means that you can use an LDAP/AD server to add new users to the Container Registry instance and manage existing accounts on the server.

Indeed, you need to set up and configure such a server before you can activate this kind of user authentication in Container Registry. How you do it, depends on your provider. You can look for instructions on the official website of the OpenLDAP project or in the Windows server official documentation.

Limitations of LDAP/AD Authentication

If you select this authentication mode, then, as a system admin, you will only be able to see a list of users in your Container Registry admin console but you won’t be able to perform any actions with them in the GUI, neither create and delete users nor change and reset their passwords. That all must be done on the LDAP or AD server. For the users, the self-registration option is not available in this mode (and you cannot enable it as an admin).

Command-Line Access for Non-Admin Users

In LDAP/AD authentication mode, non-administrator users cannot authenticate to the registry from the Docker/OCI command line with their LDAP/AD password. Basic authentication with a directory password is processed only for the built-in admin (superuser) account in this mode; for every other user — including LDAP/AD users who hold the Harbor system-administrator role — it is skipped, so a docker login with the LDAP/AD password will not succeed.

Affected users should use a robot account for docker login and other command-line operations. A system robot account can be provisioned by an administrator for cross-project access; within a single project, a project robot account works as well. Logging in to the web console with the LDAP/AD password is not affected.

Advantages of LDAP/AD Authentication

• If you already have an LDAP/AD server, you can onboard Container Registry users quicker.
• You can use the same LDAP/AD server to add and manage users of more than one Container Registry instance.
• You can create user groups and assign multiple users to projects in one leap.

LDAP User Groups

Optionally, you can create user groups to be able to assign users to projects in bulks in the Container Registry GUI.

Since an LDAP directory is a tree-like structure, it’s naturally hierarchical. Groups are a way to put entities – in our case, users – together independently of that hierarchy. One user can be a member of more than one group.

On the LDAP/AD server, you need to use the memberof attribute of the entries. If you are new to this technology, look into this tutorial that explains how to create groups on the LDAP server and add users into them.

To configure them, see Configure LDAP/AD Authentication.