{"record":{"id":"c3eeea4ac45f310d","repo":"goharbor/harbor","slug":"bad-request-c3eeea","errorCode":"BAD_REQUEST","errorMessage":"ldap group name attribute can not be empty","messagePattern":"ldap group name attribute can not be empty","errorType":"validation","errorClass":"errors.Error","httpStatus":400,"severity":"error","filePath":"src/pkg/config/validate/ldapgroup.go","lineNumber":60,"sourceCode":"\t}\n\tif val, exist := cfgs[common.LDAPGroupAttributeName]; exist {\n\t\tcfg.NameAttribute = val.(string)\n\t\tupdated = true\n\t}\n\tif val, exist := cfgs[common.LDAPGroupMembershipAttribute]; exist {\n\t\tcfg.MembershipAttribute = val.(string)\n\t\tupdated = true\n\t}\n\tif !updated {\n\t\treturn nil\n\t}\n\n\tif len(cfg.Filter) == 0 {\n\t\t// skip to validate group config\n\t\treturn nil\n\t}\n\tif len(cfg.NameAttribute) == 0 {\n\t\treturn errors.New(\"ldap group name attribute can not be empty\")\n\t}\n\tif len(cfg.MembershipAttribute) == 0 {\n\t\treturn errors.New(\"ldap group membership attribute can not be empty\")\n\t}\n\treturn nil\n}\n","sourceCodeStart":42,"sourceCodeEnd":67,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/pkg/config/validate/ldapgroup.go#L42-L67","documentation":"Harbor's LdapGroupValidateRule (run on PUT /api/v2.0/configurations) rejects an LDAP group configuration update when the merged group search filter is non-empty but the group name attribute is empty. The rule merges the submitted config items with the currently stored ones, so even a partial update is validated against the effective final config. It maps to HTTP 400 BAD_REQUEST.","triggerScenarios":"PUT /api/v2.0/configurations (or harbor.cfg/env LDAP group settings) that touches any of ldap_group_search_filter / ldap_group_attribute_name / ldap_group_membership_attribute, where the resulting merged ldap_group_search_filter is non-empty and the merged ldap_group_attribute_name is \"\" — e.g. setting the filter for the first time without a name attribute, or clearing the name attribute while a filter remains stored.","commonSituations":"Admin enables LDAP group search by setting ldap_group_search_filter (e.g. \"(objectclass=groupOfNames)\") but forgets ldap_group_attribute_name; automation tools that update only one of the three group settings at a time; upgrading Harbor where previously-saved group settings are merged with new partial payloads.","solutions":["Include ldap_group_attribute_name (typically \"cn\") in the same PUT /api/v2.0/configurations request as the filter.","GET /api/v2.0/configurations first to inspect the currently stored filter — the rule validates the merged result, not just your payload.","If group search is not needed, clear ldap_group_search_filter to \"\" so group config validation is skipped entirely."],"exampleFix":"# before\ncurl -X PUT https://harbor/api/v2.0/configurations -d '{\"ldap_group_search_filter\": \"(objectclass=groupOfNames)\"}'\n# after\ncurl -X PUT https://harbor/api/v2.0/configurations -d '{\"ldap_group_search_filter\": \"(objectclass=groupOfNames)\", \"ldap_group_attribute_name\": \"cn\", \"ldap_group_membership_attribute\": \"memberOf\"}'","handlingStrategy":"validation","validationCode":"# Client-side, before PUT /api/v2.0/configurations:\n# 1. GET /api/v2.0/configurations and read ldap_group_search_filter (merged view matters)\n# 2. Apply the same rule Harbor applies:\nif merged_filter != \"\" and merged_name_attr == \"\":\n    fail(\"set ldap_group_attribute_name (e.g. 'cn') before or together with the filter\")","typeGuard":null,"tryCatchPattern":"Treat HTTP 400 from PUT /api/v2.0/configurations as a config-shape error: read the message, fix the named attribute, and re-send the whole group-config triple in one request.","preventionTips":["Always update the three LDAP group settings (filter, name attribute, membership attribute) as one atomic PUT.","Read current configuration before partial updates — Harbor validates the merged effective config.","Automate a pre-flight check in config pipelines that replicates the rule: filter non-empty implies both attributes non-empty."],"tags":["ldap","config","validation","harbor","group-search"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}