Harbor: Not able to docker login using Robot Accounts

[arsulesandy]

I'm not able docker login using robot account. I've attached the core and registry log.

docker login *** -u robot$chitti -p <> or username with quotes
docker login *** -u 'robot$chitti' -p <>

Error response from daemon: Get http://***/v2/: Get http://...*/service/token?account=robot&client_id=docker&offline_token=true&service=harbor-registry: EOF

core.log
May 31 06:36:36 **** core[3978]: 2019/05/31 06:36:36 #033[1;44m[D] [server.go:2619] | 127.0.0.1|#033[42m 200 #033[0m| 1.537071ms| match|#033[44m GET #033[0m /api/ping r:/api/ping#033[0m
May 31 06:37:06 **** core[3978]: 2019/05/31 06:37:06 #033[1;44m[D] [server.go:2619] | 127.0.0.1|#033[42m 200 #033[0m| 631.557µs| match|#033[44m GET #033[0m /api/ping r:/api/ping#033[0m

registry.log
May 31 06:39:00 ** registry[3978]: 127.0.0.1 - - [31/May/2019:06:39:00 +0000] "GET / HTTP/1.1" 200 0 "" "curl/7.59.0"
May 31 06:39:03 ** registry[3978]: time="2019-05-31T06:39:03.988210885Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=caa65a9c-da88-451c-98c9-36943e02fff7 http.request.method=GET http.request.remoteaddr="172.19.0.7:41312" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="80.219µs" http.response.status=301 http.response.written=39
May 31 06:39:03 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:03 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
May 31 06:39:03 ** registry[3978]: time="2019-05-31T06:39:03.990070883Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=23a3ee09-fee3-4bae-a821-a936cf62a924 http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.19.0.7:41312" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
May 31 06:39:03 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:03 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"
May 31 06:39:13 ** registry[3978]: time="2019-05-31T06:39:13.98730184Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=83d60652-1301-4f61-bc29-9bf68aaa8fe8 http.request.method=GET http.request.remoteaddr="172.19.0.7:41336" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="80.191µs" http.response.status=301 http.response.written=39
May 31 06:39:13 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:13 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
May 31 06:39:13 ** registry[3978]: time="2019-05-31T06:39:13.990472557Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=4250c871-1434-4363-bb1b-09fae9fd21c0 http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.19.0.7:41336" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
May 31 06:39:13 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:13 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"
May 31 06:39:22 ** registry[3978]: time="2019-05-31T06:39:22.658869946Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host=mcrbasic.mdspcont2.siemens.cloud http.request.id=5791f75e-b8ff-4e57-9061-646a18e66a69 http.request.method=GET http.request.remoteaddr=121.241.69.196 http.request.uri="/v2/" http.request.useragent="docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 (windows))"
May 31 06:39:22 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:22 +0000] "GET /v2/ HTTP/1.1" 401 87 "" "docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 \(windows\))"
May 31 06:39:23 ** registry[3978]: time="2019-05-31T06:39:23.988405344Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=3233adaf-ea04-41f5-97e1-b20fe264c428 http.request.method=GET http.request.remoteaddr="172.19.0.7:41342" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="77.064µs" http.response.status=301 http.response.written=39
May 31 06:39:23 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:23 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
May 31 06:39:23 ** registry[3978]: time="2019-05-31T06:39:23.990301082Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=687d1db6-6a81-4eb1-92e0-d3d64b223731 http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.19.0.7:41342" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
May 31 06:39:23 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:23 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"
May 31 06:39:30 ** registry[3978]: 127.0.0.1 - - [31/May/2019:06:39:30 +0000] "GET / HTTP/1.1" 200 0 "" "curl/7.59.0"
May 31 06:39:33 ** registry[3978]: time="2019-05-31T06:39:33.988207718Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=e61cfc91-c574-40e4-bd05-09efd8d7e359 http.request.method=GET http.request.remoteaddr="172.19.0.7:41358" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="80.766µs" http.response.status=301 http.response.written=39
May 31 06:39:33 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:33 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
May 31 06:39:33 ** registry[3978]: time="2019-05-31T06:39:33.990039777Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=72559d21-ab23-4def-923f-2c162eb10887 http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.19.0.7:41358" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
May 31 06:39:33 ** registry[3978]: 172.19.0.7 - - [31/May/2019:06:39:33 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"

[jtackaberry]

docker login *** -u robot$chitti -p <> or username with quotes
docker login *** -u 'robot$chitti' -p <>

Error response from daemon: Get http://*__/v2/: Get http://_._._.*_/service/token?account=robot&client_id=docker&offline_token=true&service=harbor-registry: EOF

The error message looks like the output from the first command, not the second. Because without the single quotes, $chitti is being evaluated as a bash variable, which is why the URL shows account=robot.

The second command should have worked (and works for me).

[arsulesandy]

unfortunately both the command doesn't work for me and there is not much difference in errors using both the commands

[wy65701436]

how did you install harbor? Did you try to login with a user instead of robot account?

Please catch the different in core.log/regsitry.log with tail -f when to do login with robot account.

[arsulesandy]

core.log

**Admin Login**

Jun 3 12:07:13 *AWS_PRIVATE_URL core[3978]: 2019/06/03 12:07:13 #033[1;44m[D] [server.go:2619] | 127.0.0.1|#033[42m 200 #033[0m| 573.217µs| match|#033[44m GET #033[0m /api/ping r:/api/ping#033[0m
Jun 3 12:07:13 AWS_PRIVATE_URL core[3978]: 2019/06/03 12:07:13 #033[1;44m[D] [server.go:2619] | 121.241.69.196|#033[43m 401 #033[0m| 3.176727ms| match|#033[44m GET #033[0m /v2/ r:/v2/#033[0m
Jun 3 12:07:13 *AWS_PRIVATE_URL core[3978]: 2019/06/03 12:07:13 #033[1;44m[D] [server.go:2619] | 121.241.69.196|#033[42m 200 #033[0m| 25.59337ms| match|#033[44m GET #033[0m /service/token r:/service/token#033[0m
Jun 3 12:07:14 AWS_PRIVATE_URL core[3978]: 2019/06/03 12:07:14 #033[1;44m[D] [server.go:2619] | 121.241.69.196|#033[42m 200 #033[0m| 9.844316ms| match|#033[44m GET #033[0m /v2/ r:/v2/#033[0m

**Robot Login**

Jun 3 12:08:50 *AWS_PRIVATE_URL core[3978]: 2019/06/03 12:08:50 #033[1;44m[D] [server.go:2619] | 121.241.69.196|#033[43m 401 #033[0m| 3.553243ms| match|#033[44m GET #033[0m /v2/ r:/v2/#033[0m

---

registry.log

**Admin Login**

Jun 3 12:09:15 *AWS_PRIVATE_URL registry[3978]: 127.0.0.1 - - [03/Jun/2019:12:09:15 +0000] "GET / HTTP/1.1" 200 0 "" "curl/7.59.0"
Jun 3 12:09:22 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:22.946846073Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=c52bc433-a3d6-417f-b1d2-551905f67fb3 http.request.method=GET http.request.remoteaddr="172.22.0.7:33372" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="88.251µs" http.response.status=301 http.response.written=39
Jun 3 12:09:22 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:22 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
Jun 3 12:09:22 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:22.949297479Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=27ec4e69-48c7-47ee-a4b7-daefc749d449 http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.22.0.7:33372" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
Jun 3 12:09:22 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:22 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"
Jun 3 12:09:32 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:32.94832128Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=6aee6374-0112-42e5-98b0-fa9847983659 http.request.method=GET http.request.remoteaddr="172.22.0.7:33382" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="76.675µs" http.response.status=301 http.response.written=39
Jun 3 12:09:32 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:32 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
Jun 3 12:09:32 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:32.95038901Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=b2f8ea5d-0fea-49ad-be84-42516afeadf3 http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.22.0.7:33382" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
Jun 3 12:09:32 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:32 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"
Jun 3 12:09:42 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:42.948530602Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=93210b7e-2048-46c4-b84b-0403fa2593f8 http.request.method=GET http.request.remoteaddr="172.22.0.7:33396" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="98.93µs" http.response.status=301 http.response.written=39
Jun 3 12:09:42 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:42 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
Jun 3 12:09:42 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:42.951061513Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=47fd82d6-423b-4a59-8ce9-057d7b9cb91a http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.22.0.7:33396" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
Jun 3 12:09:42 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:42 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"
Jun 3 12:09:45 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:45.061273747Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host=3.120.205.237 http.request.id=72f798fe-3eb9-4c6a-92b5-f193d078e3d3 http.request.method=GET http.request.remoteaddr=121.241.69.196 http.request.uri="/v2/" http.request.useragent="docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 (windows))"
Jun 3 12:09:45 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:45 +0000] "GET /v2/ HTTP/1.1" 401 87 "" "docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 \(windows\))"
Jun 3 12:09:45 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:45 +0000] "GET /v2/ HTTP/1.1" 200 2 "" "docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 \(windows\))"
Jun 3 12:09:45 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:45.776775824Z" level=info msg="authorized request" go.version=go1.11.8 http.request.host=3.120.205.237 http.request.id=400a279c-d3f5-48c3-b11b-036444eb81e0 http.request.method=GET http.request.remoteaddr=121.241.69.196 http.request.uri="/v2/" http.request.useragent="docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 (windows))"
Jun 3 12:09:45 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:45.776837681Z" level=info msg="response completed" go.version=go1.11.8 http.request.host=3.120.205.237 http.request.id=400a279c-d3f5-48c3-b11b-036444eb81e0 http.request.method=GET http.request.remoteaddr=121.241.69.196 http.request.uri="/v2/" http.request.useragent="docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 (windows))" http.response.contenttype="application/json; charset=utf-8" http.response.duration=1.300944ms http.response.status=200 http.response.written=2
Jun 3 12:09:46 AWS_PRIVATE_URL registry[3978]: 127.0.0.1 - - [03/Jun/2019:12:09:46 +0000] "GET / HTTP/1.1" 200 0 "" "curl/7.59.0"
Jun 3 12:09:52 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:52.945718787Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=0ec577c9-a01e-4152-afd8-f391edc00f6f http.request.method=GET http.request.remoteaddr="172.22.0.7:33404" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="65.999µs" http.response.status=301 http.response.written=39
Jun 3 12:09:52 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:52 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
Jun 3 12:09:52 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:09:52.947985075Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=e0f590d2-c0b9-413f-96b7-97242237bcb2 http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.22.0.7:33404" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
Jun 3 12:09:52 AWS_PRIVATE_URL* registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:09:52 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"

**Robot Login**

Jun 3 12:10:16 *AWS_PRIVATE_URL registry[3978]: 127.0.0.1 - - [03/Jun/2019:12:10:16 +0000] "GET / HTTP/1.1" 200 0 "" "curl/7.59.0"
Jun 3 12:10:18 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:10:18.818528649Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host=3.120.205.237 http.request.id=bcea940a-01a6-4004-bf3c-a365337aef73 http.request.method=GET http.request.remoteaddr=121.241.69.196 http.request.uri="/v2/" http.request.useragent="docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 (windows))"
Jun 3 12:10:18 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:10:18 +0000] "GET /v2/ HTTP/1.1" 401 87 "" "docker/18.09.2 go/go1.10.6 git-commit/6247962 kernel/4.9.125-linuxkit os/linux arch/amd64 UpstreamClient(Docker-Client/18.09.2 \(windows\))"
Jun 3 12:10:22 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:10:22.945732615Z" level=info msg="response completed" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=78a8c997-f2b3-4369-a310-d1237dea588e http.request.method=GET http.request.remoteaddr="172.22.0.7:33470" http.request.uri="/v2" http.request.useragent="Go-http-client/1.1" http.response.contenttype="text/html; charset=utf-8" http.response.duration="65.248µs" http.response.status=301 http.response.written=39
Jun 3 12:10:22 AWS_PRIVATE_URL registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:10:22 +0000] "GET /v2 HTTP/1.1" 301 39 "" "Go-http-client/1.1"
Jun 3 12:10:22 AWS_PRIVATE_URL registry[3978]: time="2019-06-03T12:10:22.94850125Z" level=warning msg="error authorizing context: authorization token required" go.version=go1.11.8 http.request.host="registry:5000" http.request.id=e40f1bcf-071f-475f-98cd-ca5c4cb4ec27 http.request.method=GET http.request.referer="http://registry:5000/v2" http.request.remoteaddr="172.22.0.7:33470" http.request.uri="/v2/" http.request.useragent="Go-http-client/1.1"
Jun 3 12:10:22 AWS_PRIVATE_URL* registry[3978]: 172.22.0.7 - - [03/Jun/2019:12:10:22 +0000] "GET /v2/ HTTP/1.1" 401 87 "http://registry:5000/v2" "Go-http-client/1.1"

[oskoi]

@arsulesandy Hi!
Did you try to quote password as well?

docker login <url> -u '<robot$name>' -p '<token>'

[mxplusb]

I'm also having the same problem trying to run this pipeline on Azure DevOps:

variables:
  dockerId: robot$ci-robot 
  imageName: imagey
  tag: v0.0.$(Build.BuildNumber)

steps:
- script: |
    docker build -t $(imageName):$(tag) -f ./src/Dockerfile .
    docker login -u $(dockerId) -p $(harborPassword) cr.r3t.io
    docker push $(imageName):$(tag)
  env:
    harborPassword: $(harborPassword) 

I had to change mine to robot\$ci-robot because of the symbol choice. I appreciate the need to designate the difference between a bot and a user, but I'm not a fan of this feature. It should work out of the box, without any special tagging or symbols, as expected. Currently it breaks for me in bash, zsh, and powershell, and I have to use either robot\$ci-bot or robot`$ci-bot just to enter the bot username.

[ruiztulio]

I'd be nice if one could change the robot format name or at least the separator, because is harder to diagnose this kind of issue in a CI environment where the robot account is used the most time. Also we push to different docker repositories so the login credentials are in env vars.

As one usually use the robot account from command line makes more sense to have anoter separator or being able to configure it in harbor.

[wy65701436]

@ruiztulio can you please file a request on this? And let me close this issue as it was resolved, and actually not a bug.