{"record":{"id":"e6d242d7469dce13","repo":"goharbor/harbor","slug":"group-does-not-exist","errorCode":null,"errorMessage":"group does not exist","messagePattern":"group does not exist","errorType":"exception","errorClass":"ErrorGroupNotExist","httpStatus":null,"severity":"error","filePath":"src/core/auth/authenticator.go","lineNumber":41,"sourceCode":"\t\"github.com/goharbor/harbor/src/common\"\n\t\"github.com/goharbor/harbor/src/common/models\"\n\t\"github.com/goharbor/harbor/src/lib/config\"\n\tlibErrors \"github.com/goharbor/harbor/src/lib/errors\"\n\t\"github.com/goharbor/harbor/src/lib/log\"\n\t\"github.com/goharbor/harbor/src/pkg/user\"\n\t\"github.com/goharbor/harbor/src/pkg/usergroup/model\"\n)\n\n// 1.5 seconds\nconst frozenTime time.Duration = 1500 * time.Millisecond\n\nvar lock = NewUserLock(frozenTime)\n\n// ErrorUserNotExist ...\nvar ErrorUserNotExist = errors.New(\"user does not exist\")\n\n// ErrorGroupNotExist ...\nvar ErrorGroupNotExist = errors.New(\"group does not exist\")\n\n// ErrDuplicateLDAPGroup ...\nvar ErrDuplicateLDAPGroup = errors.New(\"a LDAP user group with same DN already exist\")\n\n// ErrInvalidLDAPGroupDN ...\nvar ErrInvalidLDAPGroupDN = errors.New(\"the LDAP group DN is invalid\")\n\n// ErrNotSupported ...\nvar ErrNotSupported = errors.New(\"not supported\")\n\n// ErrAuth is the type of error to indicate a failed authentication due to user's error.\ntype ErrAuth struct {\n\tdetails string\n}\n\n// Error ...\nfunc (ea ErrAuth) Error() string {\n\treturn fmt.Sprintf(\"Failed to authenticate user, due to error '%s'\", ea.details)","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/core/auth/authenticator.go#L23-L59","documentation":"Sentinel error ErrorGroupNotExist is returned by auth.SearchAndOnBoardGroup when the auth backend's SearchGroup succeeds but yields nil - the group key (for LDAP, the group DN; for auth proxy, the group name) resolved to no known group. It surfaces during login/onboarding of group-based users.","triggerScenarios":"An LDAP user logs in whose group DN is no longer found by the LDAP search; SearchAndOnBoardGroup is called with a group key that was removed from the directory; auth proxy group header value matches nothing.","commonSituations":"Group DN moved or deleted in AD after Harbor learned of it LDAP group base DN / group filter changed so the group falls outside the search auth proxy header delivering a stale group name.","solutions":["Verify the group still exists in LDAP/AD and lies inside the configured group base DN and GroupSearchFilter","For auth proxy, confirm the group header carries the exact current group name","Re-save the LDAP auth settings after directory changes so Harbor re-syncs groups","If the group was recreated, update Harbor user groups to the new DN"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isGroupNotExist(err error) bool { return errors.Is(err, auth.ErrorGroupNotExist) }","tryCatchPattern":"id, err := auth.SearchAndOnBoardGroup(ctx, groupDN, alt)\nif err != nil {\n    if errors.Is(err, auth.ErrorGroupNotExist) {\n        // group vanished from directory: surface a clear message, do not retry blindly\n        return fmt.Errorf(\"group %q not found in auth backend\", groupDN)\n    }\n    return err\n}","preventionTips":["Monitor group DN changes in the directory","Validate group keys against the directory in a scheduled sync job","Log the group key alongside the error for fast diagnosis"],"tags":["harbor","auth","ldap","usergroup"],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}