{"record":{"id":"b2f2e0ea4d48d763","repo":"goharbor/harbor","slug":"not-supported","errorCode":null,"errorMessage":"not supported","messagePattern":"not supported","errorType":"exception","errorClass":"ErrNotSupported","httpStatus":404,"severity":"warning","filePath":"src/core/auth/authenticator.go","lineNumber":50,"sourceCode":"// 1.5 seconds\nconst frozenTime time.Duration = 1500 * time.Millisecond\n\nvar lock = NewUserLock(frozenTime)\n\n// ErrorUserNotExist ...\nvar ErrorUserNotExist = errors.New(\"user does not exist\")\n\n// ErrorGroupNotExist ...\nvar ErrorGroupNotExist = errors.New(\"group does not exist\")\n\n// ErrDuplicateLDAPGroup ...\nvar ErrDuplicateLDAPGroup = errors.New(\"a LDAP user group with same DN already exist\")\n\n// ErrInvalidLDAPGroupDN ...\nvar ErrInvalidLDAPGroupDN = errors.New(\"the LDAP group DN is invalid\")\n\n// ErrNotSupported ...\nvar ErrNotSupported = errors.New(\"not supported\")\n\n// ErrAuth is the type of error to indicate a failed authentication due to user's error.\ntype ErrAuth struct {\n\tdetails string\n}\n\n// Error ...\nfunc (ea ErrAuth) Error() string {\n\treturn fmt.Sprintf(\"Failed to authenticate user, due to error '%s'\", ea.details)\n}\n\n// NewErrAuth ...\nfunc NewErrAuth(msg string) ErrAuth {\n\treturn ErrAuth{details: msg}\n}\n\n// AuthenticateHelper provides interface for user management in different auth modes.\ntype AuthenticateHelper interface {","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/core/auth/authenticator.go#L32-L68","documentation":"Sentinel ErrNotSupported is the default answer of DefaultAuthenticateHelper: every auth mode that does not implement an AuthenticateHelper operation (Authenticate, OnBoardUser, OnBoardGroup, SearchUser, SearchGroup) returns it. SearchUser and SearchGroup wrap it in a NotFoundError, the others return it bare.","triggerScenarios":"Calling directory-backed operations (e.g. SearchAndOnBoardGroup, OnBoardGroup) while auth_mode is db_auth, whose default helper implements none of them invoking group search in an auth mode that has no group support.","commonSituations":"Automation written against an ldap_auth Harbor is run against a db_auth instance auth mode switched to db_auth while old group-sync jobs or scripts still run.","solutions":["Switch auth_mode to ldap_auth (or another mode implementing the operation) under Configuration -> Authentication","For plain user lookup, use GET /api/v2.0/users/search which queries Harbor's DB instead of the auth backend","Gate group-related code paths on the configured auth mode before calling"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Gate directory-backed calls on auth mode before invoking them\nmode, _, _ := client.ConfigurationsApi.GetConfigurations(ctx).Execute()\nif mode.AuthMode == nil || *mode.AuthMode.Value != \"ldap_auth\" {\n    return errors.New(\"operation requires an ldap_auth deployment\")\n}","typeGuard":"func isNotSupported(err error) bool { return errors.Is(err, auth.ErrNotSupported) }","tryCatchPattern":"if err != nil {\n    if errors.Is(err, auth.ErrNotSupported) {\n        // skip gracefully: this auth mode has no directory backend\n        return nil\n    }\n    return err\n}","preventionTips":["Feature-detect auth mode before group/user directory calls","Prefer DB-backed endpoints (/api/v2.0/users/search) for generic user lookup","Document which endpoints are mode-dependent"],"tags":["harbor","auth","auth-mode","not-supported"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}