goharbor/harbor · error

the subject from userinfo: %s does not match the subject fro

Error message

the subject from userinfo: %s does not match the subject from ID token: %s, probably a security attack happened

What it means

Error "the subject from userinfo: %s does not match the subject from ID token: %s, probably a security attack happened" thrown in goharbor/harbor.

Source

Thrown at src/pkg/oidc/helper.go:306

	if err != nil {
		return nil, err
	}
	setting, err := config.OIDCSetting(ctx)
	if err != nil {
		log.Errorf("Failed to get OIDC configuration, error: %v", err)
		return nil, err
	}
	local, err := UserInfoFromIDToken(ctx, token, *setting)
	if err != nil {
		return nil, err
	}
	remote, err := userInfoFromRemote(ctx, token, *setting)
	if err != nil {
		log.Warningf("Failed to get userInfo by calling remote userinfo endpoint, error: %v ", err)
	}
	if remote != nil && local != nil {
		if remote.Subject != local.Subject {
			return nil, fmt.Errorf("the subject from userinfo: %s does not match the subject from ID token: %s, probably a security attack happened", remote.Subject, local.Subject)
		}
		return mergeUserInfo(remote, local), nil
	} else if remote != nil && local == nil {
		return remote, nil
	} else if local != nil && remote == nil {
		log.Debugf("Fall back to user data from ID token.")
		return local, nil
	}
	return nil, fmt.Errorf("failed to get userinfo from both remote and ID token")
}

func mergeUserInfo(remote, local *UserInfo) *UserInfo {
	res := &UserInfo{
		// data only contained in ID token
		Subject: local.Subject,
		Issuer:  local.Issuer,
		// Used data from userinfo
		Email: remote.Email,

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/pkg/oidc/helper.go:306 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/a7fc0ecbf0b7acd3. Report an issue: GitHub.