goharbor/harbor · error · SecretVerifyError

secret mismatch, username: %s

Error message

secret mismatch, username: %s

What it means

Error "secret mismatch, username: %s" thrown in goharbor/harbor.

Source

Thrown at src/pkg/oidc/secret.go:105

func (dm *defaultManager) VerifySecret(ctx context.Context, username string, secret string) (*UserInfo, error) {
	log.Debugf("Verifying the secret for user: %s", username)
	oidcUser, err := dm.metaDao.GetByUsername(ctx, username)
	if err != nil {
		return nil, fmt.Errorf("failed to get oidc user info, error: %v", err)
	}
	if oidcUser == nil {
		return nil, fmt.Errorf("user is not onboarded as OIDC user, username: %s", username)
	}
	key, err := keyLoader.encryptKey()
	if err != nil {
		return nil, fmt.Errorf("failed to load the key for encryption/decryption： %v", err)
	}
	plainSecret, err := utils.ReversibleDecrypt(oidcUser.Secret, key)
	if err != nil {
		return nil, fmt.Errorf("failed to decrypt secret from DB: %v", err)
	}
	if subtle.ConstantTimeCompare([]byte(secret), []byte(plainSecret)) != 1 {
		return nil, verifyError(fmt.Errorf("secret mismatch, username: %s", username))
	}
	tokenStr, err := utils.ReversibleDecrypt(oidcUser.Token, key)
	if err != nil {
		return nil, verifyError(err)
	}
	token := &Token{}
	err = json.Unmarshal(([]byte)(tokenStr), token)
	if err != nil {
		return nil, verifyError(err)
	}
	if !token.Valid() {
		log.Debug("Refreshing token")
		token, err = refreshToken(ctx, token)
		if err != nil {
			return nil, fmt.Errorf("failed to refresh token, username: %s, error: %v", username, err)
		}
		tb, err := json.Marshal(token)
		if err != nil {

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/pkg/oidc/secret.go:105 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/c6b10341554d8224. Report an issue: GitHub.