goharbor/harbor · error

invalid credential

Error message

invalid credential

What it means

Sentinel error returned by ldap.TestConfig (POST /api/v2.0/ldap/ping) when binding as the search DN fails with LDAP result code 49 (invalidCredentials): the search DN or search password is wrong for the directory server. The connection itself succeeded; only authentication failed.

Source

Thrown at src/pkg/ldap/ldap.go:42

	"time"

	goldap "github.com/go-ldap/ldap/v3"

	"github.com/goharbor/harbor/src/lib/config/models"
	"github.com/goharbor/harbor/src/lib/log"
	"github.com/goharbor/harbor/src/pkg/ldap/model"
)

const pageSize = 1000

// ErrNotFound ...
var ErrNotFound = errors.New("entity not found")

// ErrEmptyPassword ...
var ErrEmptyPassword = errors.New("empty password")

// ErrInvalidCredential ...
var ErrInvalidCredential = errors.New("invalid credential")

// ErrLDAPServerTimeout ...
var ErrLDAPServerTimeout = errors.New("ldap server network timeout")

// ErrLDAPPingFail ...
var ErrLDAPPingFail = errors.New("fail to ping LDAP server")

// ErrDNSyntax ...
var ErrDNSyntax = errors.New("invalid DN syntax")

// ErrInvalidFilter ...
var ErrInvalidFilter = errors.New("invalid filter syntax")

// ErrEmptyBaseDN ...
var ErrEmptyBaseDN = errors.New("empty base dn")

// ErrEmptySearchDN ...
var ErrEmptySearchDN = errors.New("empty search dn")

View on GitHub (pinned to 7b2fd08cc5)

Solutions

1. Prove the credentials outside Harbor first: ldapwhoami -H ldap://host -D '<search_dn>' -W.
2. Fix the DN spelling/order (verify the account's actual DN in AD Users & Computers / ldapsearch).
3. Save the corrected pair via PUT /api/v2.0/configurations (ldap_search_dn + ldap_search_password), then re-run POST /api/v2.0/ldap/ping.

Example fix

# before
curl -X POST https://harbor/api/v2.0/ldap/ping -d '{"url": "ldap://ad.example.com", "search_dn": "cn=harbor,dc=example,dc=com", "search_password": "wrong"}'
# after
curl -X POST https://harbor/api/v2.0/ldap/ping -d '{"url": "ldap://ad.example.com", "search_dn": "cn=svc-harbor,ou=serviceaccounts,dc=example,dc=com", "search_password": "correct"}'

# Prove credentials out-of-band before configuring Harbor:
ldapwhoami -H ldap://ad.example.com -D 'cn=svc-harbor,ou=svc,dc=example,dc=com' -W
# exit code 0 -> safe to PUT into Harbor configuration

func isLdapInvalidCredential(err error) bool { return errors.Is(err, ldap.ErrInvalidCredential) }

if errors.Is(err, ldap.ErrInvalidCredential) {
    // connection was fine; the bind DN/password is wrong — re-verify with ldapwhoami, update
    // ldap_search_dn / ldap_search_password, then re-run POST /api/v2.0/ldap/ping
}

When it happens

Trigger: POST /api/v2.0/ldap/ping where ldap_search_dn is malformed (bad RDN order, typo, wrong casing in AD) or ldap_search_password is expired/rotated/wrong; also logins and user searches later, since every session binds with this DN.

Common situations: AD service-account password rotated on a schedule and the new value never saved to Harbor; DN built as "cn=svc,dc=example,dc=com,ou=svc" (wrong component order); account locked out or disabled; password pasted with trailing whitespace or shell-escaped incorrectly.

Related errors

• empty password
• Unauthorized
• group does not exist
• BAD_REQUEST
• fail to ping LDAP server

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/4c123f2e746ef2d9. Report an issue: GitHub.