goharbor/harbor · warning · ErrNotSupported

not supported

Error message

not supported

What it means

Sentinel ErrNotSupported is the default answer of DefaultAuthenticateHelper: every auth mode that does not implement an AuthenticateHelper operation (Authenticate, OnBoardUser, OnBoardGroup, SearchUser, SearchGroup) returns it. SearchUser and SearchGroup wrap it in a NotFoundError, the others return it bare.

Source

Thrown at src/core/auth/authenticator.go:50

// 1.5 seconds
const frozenTime time.Duration = 1500 * time.Millisecond

var lock = NewUserLock(frozenTime)

// ErrorUserNotExist ...
var ErrorUserNotExist = errors.New("user does not exist")

// ErrorGroupNotExist ...
var ErrorGroupNotExist = errors.New("group does not exist")

// ErrDuplicateLDAPGroup ...
var ErrDuplicateLDAPGroup = errors.New("a LDAP user group with same DN already exist")

// ErrInvalidLDAPGroupDN ...
var ErrInvalidLDAPGroupDN = errors.New("the LDAP group DN is invalid")

// ErrNotSupported ...
var ErrNotSupported = errors.New("not supported")

// ErrAuth is the type of error to indicate a failed authentication due to user's error.
type ErrAuth struct {
	details string
}

// Error ...
func (ea ErrAuth) Error() string {
	return fmt.Sprintf("Failed to authenticate user, due to error '%s'", ea.details)
}

// NewErrAuth ...
func NewErrAuth(msg string) ErrAuth {
	return ErrAuth{details: msg}
}

// AuthenticateHelper provides interface for user management in different auth modes.
type AuthenticateHelper interface {

View on GitHub (pinned to 7b2fd08cc5)

Solutions

1. Switch auth_mode to ldap_auth (or another mode implementing the operation) under Configuration -> Authentication
2. For plain user lookup, use GET /api/v2.0/users/search which queries Harbor's DB instead of the auth backend
3. Gate group-related code paths on the configured auth mode before calling

// Gate directory-backed calls on auth mode before invoking them
mode, _, _ := client.ConfigurationsApi.GetConfigurations(ctx).Execute()
if mode.AuthMode == nil || *mode.AuthMode.Value != "ldap_auth" {
    return errors.New("operation requires an ldap_auth deployment")
}

func isNotSupported(err error) bool { return errors.Is(err, auth.ErrNotSupported) }

if err != nil {
    if errors.Is(err, auth.ErrNotSupported) {
        // skip gracefully: this auth mode has no directory backend
        return nil
    }
    return err
}

When it happens

Trigger: Calling directory-backed operations (e.g. SearchAndOnBoardGroup, OnBoardGroup) while auth_mode is db_auth, whose default helper implements none of them invoking group search in an auth mode that has no group support.

Common situations: Automation written against an ldap_auth Harbor is run against a db_auth instance auth mode switched to db_auth while old group-sync jobs or scripts still run.

Related errors

• Unauthorized
• group does not exist
• nil request
• empty secret is not allowed
• unauthorized

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/b2f2e0ea4d48d763. Report an issue: GitHub.