goharbor/harbor · error

unsupported auth scheme

Error message

unsupported auth scheme: %v

What it means

Returned by the registry authorizer's initialize when the /v2/ challenges advertise neither 'bearer' nor 'basic' schemes (or no challenges map to a supported scheme). After preferring bearer and basic, no supported authorizer can be constructed, so the scheme list is reported. It fires when the registry uses an authentication scheme Harbor's client does not implement.

Solutions

1. Inspect the registry's WWW-Authenticate challenges on /v2/
2. Configure the registry to use bearer token or basic authentication
3. Check for proxies that rewrite or strip auth challenge headers
4. Verify the registry is a supported Docker Registry v2 implementation

When it happens

Trigger: Thrown at src/pkg/registry/auth/authorizer.go:137 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/1997b5c66a3c19aa. Report an issue: GitHub.

Appendix: source

Thrown at src/pkg/registry/auth/authorizer.go:137

	if len(challenges) == 0 {
		a.authorizer = null.NewAuthorizer()
		return nil
	}
	cm := map[string]challenge.Challenge{}
	for _, challenge := range challenges {
		cm[challenge.Scheme] = challenge
	}
	if challenge, exist := cm["bearer"]; exist {
		a.authorizer = bearer.NewAuthorizer(challenge.Parameters["realm"],
			challenge.Parameters["service"], basic.NewAuthorizer(a.username, a.password),
			a.client.Transport)
		return nil
	}
	if _, exist := cm["basic"]; exist {
		a.authorizer = basic.NewAuthorizer(a.username, a.password)
		return nil
	}
	return fmt.Errorf("unsupported auth scheme: %v", challenges)
}

// Check whether the request targets to the registry.
// If doesn't, the request shouldn't be handled by the authorizer.
// e.g. the requests sent to backend storage(s3, etc.)
func (a *authorizer) isTarget(req *http.Request) bool {
	index := strings.Index(req.URL.Path, "/v2/")
	if index == -1 {
		return false
	}
	if req.URL.Host != a.url.Host || req.URL.Scheme != a.url.Scheme ||
		req.URL.Path[:index+4] != a.url.Path {
		return false
	}
	return true
}

View on GitHub (pinned to 7b2fd08cc5)