goharbor/harbor · error

failed to get userinfo from both remote and ID token

Error message

failed to get userinfo from both remote and ID token

What it means

Error "failed to get userinfo from both remote and ID token" thrown in goharbor/harbor.

Source

Thrown at src/pkg/oidc/helper.go:315

	if err != nil {
		return nil, err
	}
	remote, err := userInfoFromRemote(ctx, token, *setting)
	if err != nil {
		log.Warningf("Failed to get userInfo by calling remote userinfo endpoint, error: %v ", err)
	}
	if remote != nil && local != nil {
		if remote.Subject != local.Subject {
			return nil, fmt.Errorf("the subject from userinfo: %s does not match the subject from ID token: %s, probably a security attack happened", remote.Subject, local.Subject)
		}
		return mergeUserInfo(remote, local), nil
	} else if remote != nil && local == nil {
		return remote, nil
	} else if local != nil && remote == nil {
		log.Debugf("Fall back to user data from ID token.")
		return local, nil
	}
	return nil, fmt.Errorf("failed to get userinfo from both remote and ID token")
}

func mergeUserInfo(remote, local *UserInfo) *UserInfo {
	res := &UserInfo{
		// data only contained in ID token
		Subject: local.Subject,
		Issuer:  local.Issuer,
		// Used data from userinfo
		Email: remote.Email,
	}
	// priority for username (high to low):
	// 1. Username based on the auto onboard claim from ID token
	// 2. Username from response of userinfo endpoint
	// 3. Username from the default "name" claim from ID token
	if local.autoOnboardUsername != "" {
		res.Username = local.autoOnboardUsername
	} else if remote.Username != "" {
		res.Username = remote.Username

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/pkg/oidc/helper.go:315 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/bdeaaf9745269c6c. Report an issue: GitHub.