goharbor/harbor · error · errors.Error
BAD_REQUEST
BAD_REQUEST
Error message
ldap group name attribute can not be empty
What it means
Harbor's LdapGroupValidateRule (run on PUT /api/v2.0/configurations) rejects an LDAP group configuration update when the merged group search filter is non-empty but the group name attribute is empty. The rule merges the submitted config items with the currently stored ones, so even a partial update is validated against the effective final config. It maps to HTTP 400 BAD_REQUEST.
Source
Thrown at src/pkg/config/validate/ldapgroup.go:60
}
if val, exist := cfgs[common.LDAPGroupAttributeName]; exist {
cfg.NameAttribute = val.(string)
updated = true
}
if val, exist := cfgs[common.LDAPGroupMembershipAttribute]; exist {
cfg.MembershipAttribute = val.(string)
updated = true
}
if !updated {
return nil
}
if len(cfg.Filter) == 0 {
// skip to validate group config
return nil
}
if len(cfg.NameAttribute) == 0 {
return errors.New("ldap group name attribute can not be empty")
}
if len(cfg.MembershipAttribute) == 0 {
return errors.New("ldap group membership attribute can not be empty")
}
return nil
}
View on GitHub (pinned to 7b2fd08cc5)
Solutions
- Include ldap_group_attribute_name (typically "cn") in the same PUT /api/v2.0/configurations request as the filter.
- GET /api/v2.0/configurations first to inspect the currently stored filter — the rule validates the merged result, not just your payload.
- If group search is not needed, clear ldap_group_search_filter to "" so group config validation is skipped entirely.
Example fix
# before
curl -X PUT https://harbor/api/v2.0/configurations -d '{"ldap_group_search_filter": "(objectclass=groupOfNames)"}'
# after
curl -X PUT https://harbor/api/v2.0/configurations -d '{"ldap_group_search_filter": "(objectclass=groupOfNames)", "ldap_group_attribute_name": "cn", "ldap_group_membership_attribute": "memberOf"}' Defensive patterns
Strategy: validation
Validate before calling
# Client-side, before PUT /api/v2.0/configurations:
# 1. GET /api/v2.0/configurations and read ldap_group_search_filter (merged view matters)
# 2. Apply the same rule Harbor applies:
if merged_filter != "" and merged_name_attr == "":
fail("set ldap_group_attribute_name (e.g. 'cn') before or together with the filter") Try / catch
Treat HTTP 400 from PUT /api/v2.0/configurations as a config-shape error: read the message, fix the named attribute, and re-send the whole group-config triple in one request.
Prevention
- Always update the three LDAP group settings (filter, name attribute, membership attribute) as one atomic PUT.
- Read current configuration before partial updates — Harbor validates the merged effective config.
- Automate a pre-flight check in config pipelines that replicates the rule: filter non-empty implies both attributes non-empty.
When it happens
Trigger: PUT /api/v2.0/configurations (or harbor.cfg/env LDAP group settings) that touches any of ldap_group_search_filter / ldap_group_attribute_name / ldap_group_membership_attribute, where the resulting merged ldap_group_search_filter is non-empty and the merged ldap_group_attribute_name is "" — e.g. setting the filter for the first time without a name attribute, or clearing the name attribute while a filter remains stored.
Common situations: Admin enables LDAP group search by setting ldap_group_search_filter (e.g. "(objectclass=groupOfNames)") but forgets ldap_group_attribute_name; automation tools that update only one of the three group settings at a time; upgrading Harbor where previously-saved group settings are merged with new partial payloads.
Related errors
AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16).
Data as JSON: /api/errors/c3eeea4ac45f310d.
Report an issue: GitHub.