Harbor Token Expiration (Minutes) setting

[ep4sh]

Dear community, could you please explain some features regarding token lifetime with OIDC.

I use OIDC (keycloak) and harbor (works perfectly, btw).

My token expiration is 360min, but it looks like the token is being expired earlier than the desired timeframe. I guess it could depend on OIDC parameter like refresh token, isn't it?

thanks in advance, P.

[wy65701436]

the token expiration is for the distribution v2 api token to pull artifacts, and the second session timeout is for the harbor UI session timeout.

Can you explain the issue that you have in details?

[ep4sh]

Sure, as you can see, I set up 360 minutes for token expiration, unfortunately, I'm getting unauthorized error for docker CLI (approximately) every 50–60 minutes. Then I have to open harbor UI, logout, login with Keycloak, exec docker login.

I just want to perform those operations once a day (let's say once in 360m).

If you're curious about versions:

• harbor v2.12.2
• Docker version 27.5.1, build 9f9e405801

Thanks!

[fangzhengjin]

same problem

[ep4sh]

My guess is when the token is being created here (from user config):

• https://github.com/goharbor/harbor/blob/main/src/core/service/token/authutils.go#L118 But unfortunately, user config loading is missing:
• https://github.com/goharbor/harbor/blob/main/src/lib/config/userconfig.go#L94

So the default config (DefaultMgr) was used. I've also created a draft PR for it, please check.

Thanks, P.

[github-actions[bot]]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

[ep4sh]

Still facing the issue

[smuglik]

Hello! I'm experiencing the same issue. I'm facing similar symptoms where the token expires earlier than expected, and I have to re-authenticate. Hoping that the proposed solution will help me too. Will be following the updates!

[Sergey-Pravdyukov]

Completely agree with @ep4sh and @smuglik

[tla-ou-tpla]

I'm getting unauthorized error for docker CLI (approximately) every 50–60 minutes. Then I have to open harbor UI, logout, login with Keycloak, exec docker login.

FYI, on our side when we receive a 401: Unauthorized (e.g. pulling a chart or image), this solves it :

1. Logout from Harbor UI
2. Login in Harbor UI (using the OIDC, Keycloak as well)
3. Run the failing command again from the terminal, and it just works (e.g. helm dep build, docker pull <image-from-harbor>)

AFAIK, no need to re-login like docker login.

Further details : https://github.com/goharbor/harbor/pull/21677#issuecomment-3112489304

[github-actions[bot]]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

[ep4sh]

Hi folks, not sure if I'm able to provide any additional details on the issue, could you please point me out, what's the next step to take? =}

thanks, P.

[github-actions[bot]]

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.