{"record":{"id":"4c123f2e746ef2d9","repo":"goharbor/harbor","slug":"invalid-credential","errorCode":null,"errorMessage":"invalid credential","messagePattern":"invalid credential","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/pkg/ldap/ldap.go","lineNumber":42,"sourceCode":"\t\"time\"\n\n\tgoldap \"github.com/go-ldap/ldap/v3\"\n\n\t\"github.com/goharbor/harbor/src/lib/config/models\"\n\t\"github.com/goharbor/harbor/src/lib/log\"\n\t\"github.com/goharbor/harbor/src/pkg/ldap/model\"\n)\n\nconst pageSize = 1000\n\n// ErrNotFound ...\nvar ErrNotFound = errors.New(\"entity not found\")\n\n// ErrEmptyPassword ...\nvar ErrEmptyPassword = errors.New(\"empty password\")\n\n// ErrInvalidCredential ...\nvar ErrInvalidCredential = errors.New(\"invalid credential\")\n\n// ErrLDAPServerTimeout ...\nvar ErrLDAPServerTimeout = errors.New(\"ldap server network timeout\")\n\n// ErrLDAPPingFail ...\nvar ErrLDAPPingFail = errors.New(\"fail to ping LDAP server\")\n\n// ErrDNSyntax ...\nvar ErrDNSyntax = errors.New(\"invalid DN syntax\")\n\n// ErrInvalidFilter ...\nvar ErrInvalidFilter = errors.New(\"invalid filter syntax\")\n\n// ErrEmptyBaseDN ...\nvar ErrEmptyBaseDN = errors.New(\"empty base dn\")\n\n// ErrEmptySearchDN ...\nvar ErrEmptySearchDN = errors.New(\"empty search dn\")","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/pkg/ldap/ldap.go#L24-L60","documentation":"Sentinel error returned by ldap.TestConfig (POST /api/v2.0/ldap/ping) when binding as the search DN fails with LDAP result code 49 (invalidCredentials): the search DN or search password is wrong for the directory server. The connection itself succeeded; only authentication failed.","triggerScenarios":"POST /api/v2.0/ldap/ping where ldap_search_dn is malformed (bad RDN order, typo, wrong casing in AD) or ldap_search_password is expired/rotated/wrong; also logins and user searches later, since every session binds with this DN.","commonSituations":"AD service-account password rotated on a schedule and the new value never saved to Harbor; DN built as \"cn=svc,dc=example,dc=com,ou=svc\" (wrong component order); account locked out or disabled; password pasted with trailing whitespace or shell-escaped incorrectly.","solutions":["Prove the credentials outside Harbor first: ldapwhoami -H ldap://host -D '<search_dn>' -W.","Fix the DN spelling/order (verify the account's actual DN in AD Users & Computers / ldapsearch).","Save the corrected pair via PUT /api/v2.0/configurations (ldap_search_dn + ldap_search_password), then re-run POST /api/v2.0/ldap/ping."],"exampleFix":"# before\ncurl -X POST https://harbor/api/v2.0/ldap/ping -d '{\"url\": \"ldap://ad.example.com\", \"search_dn\": \"cn=harbor,dc=example,dc=com\", \"search_password\": \"wrong\"}'\n# after\ncurl -X POST https://harbor/api/v2.0/ldap/ping -d '{\"url\": \"ldap://ad.example.com\", \"search_dn\": \"cn=svc-harbor,ou=serviceaccounts,dc=example,dc=com\", \"search_password\": \"correct\"}'","handlingStrategy":"validation","validationCode":"# Prove credentials out-of-band before configuring Harbor:\nldapwhoami -H ldap://ad.example.com -D 'cn=svc-harbor,ou=svc,dc=example,dc=com' -W\n# exit code 0 -> safe to PUT into Harbor configuration","typeGuard":"func isLdapInvalidCredential(err error) bool { return errors.Is(err, ldap.ErrInvalidCredential) }","tryCatchPattern":"if errors.Is(err, ldap.ErrInvalidCredential) {\n    // connection was fine; the bind DN/password is wrong — re-verify with ldapwhoami, update\n    // ldap_search_dn / ldap_search_password, then re-run POST /api/v2.0/ldap/ping\n}","preventionTips":["Verify bind DN/password with ldapwhoami/ldapsearch before saving to Harbor.","Track service-account password rotation and update Harbor the same day.","Watch for AD lockouts from repeated failed binds during debugging."],"tags":["ldap","auth","credentials","config"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}