goharbor/harbor · warning · ErrInvalidLDAPGroupDN

the LDAP group DN is invalid

Error message

the LDAP group DN is invalid

What it means

Sentinel ErrInvalidLDAPGroupDN is returned by the LDAP auth helper (ldap.go:274 and 307) when a group DN fails validation - the string is not a structurally valid LDAP distinguished name or the search on it cannot be built. It is a data-format rejection, not a connectivity error.

Source

Thrown at src/core/auth/authenticator.go:47

	"github.com/goharbor/harbor/src/pkg/usergroup/model"
)

// 1.5 seconds
const frozenTime time.Duration = 1500 * time.Millisecond

var lock = NewUserLock(frozenTime)

// ErrorUserNotExist ...
var ErrorUserNotExist = errors.New("user does not exist")

// ErrorGroupNotExist ...
var ErrorGroupNotExist = errors.New("group does not exist")

// ErrDuplicateLDAPGroup ...
var ErrDuplicateLDAPGroup = errors.New("a LDAP user group with same DN already exist")

// ErrInvalidLDAPGroupDN ...
var ErrInvalidLDAPGroupDN = errors.New("the LDAP group DN is invalid")

// ErrNotSupported ...
var ErrNotSupported = errors.New("not supported")

// ErrAuth is the type of error to indicate a failed authentication due to user's error.
type ErrAuth struct {
	details string
}

// Error ...
func (ea ErrAuth) Error() string {
	return fmt.Sprintf("Failed to authenticate user, due to error '%s'", ea.details)
}

// NewErrAuth ...
func NewErrAuth(msg string) ErrAuth {
	return ErrAuth{details: msg}
}

View on GitHub (pinned to 7b2fd08cc5)

Solutions

1. Submit a full comma-separated DN: cn=<group>,ou=...,dc=...
2. Trim whitespace and check each component has a valid attribute prefix (cn, ou, dc, o)
3. Validate with ldapsearch -b '<DN>' against the directory before configuring Harbor

Example fix

// before
"ldap_group_dn": "dev-team"

// after
"ldap_group_dn": "cn=dev-team,ou=groups,dc=example,dc=com"

var dnPattern = regexp.MustCompile(`^(?:CN|OU|DC)=[^,]+(?:,(?:CN|OU|DC|O)=[^,]+)*$`)
func validDN(s string) bool {
    s = strings.TrimSpace(s)
    return s != "" && dnPattern.MatchString(s) && !strings.Contains(s, "  ")
}
if !validDN(dn) { return errors.New("refusing to submit malformed DN") }

func isInvalidLDAPGroupDN(err error) bool { return errors.Is(err, auth.ErrInvalidLDAPGroupDN) }

if errors.Is(err, auth.ErrInvalidLDAPGroupDN) {
    return fmt.Errorf("group DN %q is malformed: expected cn=...,ou=...,dc=...", dn)
}

When it happens

Trigger: POST/PUT /api/v2.0/usergroups (LDAP type) with a malformed DN such as plain 'devs' instead of 'cn=devs,ou=groups,dc=example,dc=com'; trailing spaces or broken attribute components in the DN.

Common situations: Admins entering only the group CN instead of the full DN copy/paste with invisible characters, smart quotes, or wrong attribute order (dc/cn/ou).

Related errors

• group does not exist
• a LDAP user group with same DN already exist
• should provide a group name
• BAD_REQUEST
• File {} not exist

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/757f5ea52365068a. Report an issue: GitHub.