{"record":{"id":"a7fc0ecbf0b7acd3","repo":"goharbor/harbor","slug":"the-subject-from-userinfo-s-does-not-match-the-s","errorCode":null,"errorMessage":"the subject from userinfo: %s does not match the subject from ID token: %s, probably a security attack happened","messagePattern":"the subject from userinfo: (.+?) does not match the subject from ID token: (.+?), probably a security attack happened","errorType":"exception","errorClass":null,"httpStatus":500,"severity":"error","filePath":"src/pkg/oidc/helper.go","lineNumber":306,"sourceCode":"\tif err != nil {\n\t\treturn nil, err\n\t}\n\tsetting, err := config.OIDCSetting(ctx)\n\tif err != nil {\n\t\tlog.Errorf(\"Failed to get OIDC configuration, error: %v\", err)\n\t\treturn nil, err\n\t}\n\tlocal, err := UserInfoFromIDToken(ctx, token, *setting)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tremote, err := userInfoFromRemote(ctx, token, *setting)\n\tif err != nil {\n\t\tlog.Warningf(\"Failed to get userInfo by calling remote userinfo endpoint, error: %v \", err)\n\t}\n\tif remote != nil && local != nil {\n\t\tif remote.Subject != local.Subject {\n\t\t\treturn nil, fmt.Errorf(\"the subject from userinfo: %s does not match the subject from ID token: %s, probably a security attack happened\", remote.Subject, local.Subject)\n\t\t}\n\t\treturn mergeUserInfo(remote, local), nil\n\t} else if remote != nil && local == nil {\n\t\treturn remote, nil\n\t} else if local != nil && remote == nil {\n\t\tlog.Debugf(\"Fall back to user data from ID token.\")\n\t\treturn local, nil\n\t}\n\treturn nil, fmt.Errorf(\"failed to get userinfo from both remote and ID token\")\n}\n\nfunc mergeUserInfo(remote, local *UserInfo) *UserInfo {\n\tres := &UserInfo{\n\t\t// data only contained in ID token\n\t\tSubject: local.Subject,\n\t\tIssuer:  local.Issuer,\n\t\t// Used data from userinfo\n\t\tEmail: remote.Email,","sourceCodeStart":288,"sourceCodeEnd":324,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/pkg/oidc/helper.go#L288-L324","documentation":"Error \"the subject from userinfo: %s does not match the subject from ID token: %s, probably a security attack happened\" thrown in goharbor/harbor.","triggerScenarios":"Thrown at src/pkg/oidc/helper.go:306 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}