Harbor: Token authentication

[roldancer]

Hi All,
Can Harbor create token for users ? I would like to login via token, is it possible?

Thanks.

[reasonerjt]

Current code doesn't support login via token, we're thinking to decouple that, the implementation may come in Q2.

[momobou]

Hi all,

Any news about this request? Can we now login to harbor registry using token?

Thank you for your help

[gcavalcante8808]

Hello Folks,

Any News about this?

[ghost]

Hi folks – still nothing to share. Will update this issue when we do.

[reasonerjt]

@roldancer Could you provide more details about this feature?

[MichaelPereira]

Using tokens makes it much easier to interact with the service via service accounts. Instead of having to share usernames/passwords with other systems, it would be very useful to generate system-specific tokens for a single user.

This would allow tokens to be invalidated without needed to go through the more complex process of changing a system user password (especially when those users need to be LDAP ones).

[snayler0]

+1 This would be a great addition imo!

[prbsparx]

+1 tokens would allow us to more easily deploy images stored in Harbor in an automated fashion.

[reasonerjt]

In 1.8 we have supported OIDC integration, and robot account seems it addresses most of the requirement in this issue?

[pavel-z1]

@roldancer Could you provide more details about this feature?

We have LDAP server with enabled two factor authentication (2fa).
As we have second factor, docker login does not work with ldap password that include password+second factor

We need solution like Docker Hub has - User personal access token, that can be used in docker login cli command
User should able to login into Harbor UI, and get inside Profile page his personal token.

[jgallucci32]

@reasonerjt Thank you for the comment. In our case we use access tokens for our service accounts but I always hated how it is tied to a personal account in other registries. Robot accounts does what I was looking for in the first place and I agree should address the original requirements of this issue.