goharbor/harbor · error

entity not found

Error message

entity not found

What it means

Sentinel error in Harbor's LDAP package, returned by Session.SearchGroupByDN when the LDAP/AD server answers LDAPResultNoSuchObject — the group DN being used as the search base does not exist in the directory. It flows out of group search (Harbor API POST /api/v2.0/ldap/groups/search with a group DN) and during LDAP group sync when resolving a user's memberOf DNs.

Source

Thrown at src/pkg/ldap/ldap.go:36

	"crypto/tls"
	"errors"
	"fmt"
	"net"
	"net/url"
	"strings"
	"time"

	goldap "github.com/go-ldap/ldap/v3"

	"github.com/goharbor/harbor/src/lib/config/models"
	"github.com/goharbor/harbor/src/lib/log"
	"github.com/goharbor/harbor/src/pkg/ldap/model"
)

const pageSize = 1000

// ErrNotFound ...
var ErrNotFound = errors.New("entity not found")

// ErrEmptyPassword ...
var ErrEmptyPassword = errors.New("empty password")

// ErrInvalidCredential ...
var ErrInvalidCredential = errors.New("invalid credential")

// ErrLDAPServerTimeout ...
var ErrLDAPServerTimeout = errors.New("ldap server network timeout")

// ErrLDAPPingFail ...
var ErrLDAPPingFail = errors.New("fail to ping LDAP server")

// ErrDNSyntax ...
var ErrDNSyntax = errors.New("invalid DN syntax")

// ErrInvalidFilter ...
var ErrInvalidFilter = errors.New("invalid filter syntax")

View on GitHub (pinned to 7b2fd08cc5)

Solutions

1. Verify the group base DN and the failing group DN with an external tool: ldapsearch -H ldap://host -b '<dn>' -s base '(objectclass=*)'.
2. Correct ldap_group_base_dn in the configuration if it points to a nonexistent subtree.
3. Treat ErrNotFound as skip-able during sync (group no longer exists) rather than fatal — filter stale DNs before calling SearchGroupByDN.

Example fix

// Go: before
groups, err := session.SearchGroupByDN(dn)
if err != nil { return err }
// after
groups, err := session.SearchGroupByDN(dn)
if errors.Is(err, ldap.ErrNotFound) {
    log.Warnf("group %s no longer exists in LDAP, skipping", dn)
    return nil
}
if err != nil { return err }

// Go: cheap pre-checks before SearchGroupByDN
if _, err := goldap.ParseDN(groupDN); err != nil { /* bad DN — fix data */ }
// Optionally verify the DN exists with a base-scope search before relying on it

// Go
import "errors"
import harborldap "github.com/goharbor/harbor/src/pkg/ldap"

func isGroupNotFound(err error) bool {
    return errors.Is(err, harborldap.ErrNotFound)
}

groups, err := session.SearchGroupByDN(dn)
if err != nil {
    if errors.Is(err, ldap.ErrNotFound) {
        // group DN no longer exists in the directory: skip it (stale memberOf), don't fail the sync
        continue
    }
    return err
}

When it happens

Trigger: Calling SearchGroupByDN (directly or via the groups-search API / group sync) with a DN that has been deleted, or when ldap_group_base_dn points at a nonexistent subtree so the server returns 'No Such Object' for the base.

Common situations: Groups deleted/renamed in Active Directory while users still carry the stale DN in memberOf; typos in ldap_group_base_dn; cross-domain/forest setups where memberOf references DNs from a domain Harbor's configured base cannot see.

Related errors

• group does not exist
• a LDAP user group with same DN already exist
• the LDAP group DN is invalid
• BAD_REQUEST
• empty password

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/dab1435115f190cf. Report an issue: GitHub.