Can't use Docker Registry V2 HTTPS API w/ Harbor Registry. #13653

Clovel · 2020-12-01T11:04:38Z

Issue

By trying to use the standard Docker Registry V2 HTTPS API with node-fetch & with cURL, I only get the UNAUTHORIZED error code.

Here is an example request :

curl -X GET -u user:password "https://ID.gra7.container-registry.ovh.net/v2/_catalog"

and the result

{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}

The user and the password work to connect to the Harbor GUI & also work with docker login.

I cannot find any resources online about this issue. I need access to the following standard API requests :

GET /_catalog
GET /{repository}/tags/list
HEAD /{repository}/manifests/{tag}
DELETE /{repository}/manifests/{tag}

These requests work as intended with other standard Docker Registries. How can I use them with Harbor ?

Thanks for your help.

More results

GET /_catalog

{
  "errors": [
    {
      "code":"UNAUTHORIZED",
      "message":"authentication required",
      "detail": [
        {
          "Type":"registry",
          "Class":"",
          "Name":"catalog",
          "Action":"*"
        }
      ]
    }
  ]
}

GET /{repository}/tags/list

{
  "errors": [
    {
      "code":"UNAUTHORIZED",
      "message":"authentication required",
      "detail": [
        {
          "Type":"repository",
          "Class":"",
          "Name":"<subdir>/<reponame>",
          "Action":"pull"
        }
      ]
    }
  ]
}

HEAD /{repository}/manifests/{tag}

HTTP/2 401
date: Tue, 01 Dec 2020 11:01:46 GMT
content-type: application/json; charset=utf-8
content-length: 168
docker-distribution-api-version: registry/2.0
www-authenticate: Bearer realm="https://ID.gra7.container-registry.ovh.net/service/token",service="harbor-registry",scope="repository:<subdir>/<reponame>:pull"
x-content-type-options: nosniff
strict-transport-security: max-age=15724800; includeSubDomains
x-ovh-ingress: public-ingress

DELETE /{repository}/manifests/{tag}

{
  "errors": [
    {
      "code":"UNAUTHORIZED",
      "message":"authentication required",
      "detail": [
        {
          "Type":"repository",
          "Class":"",
          "Name":"<subdir>/<reponame>",
          "Action":"delete"
        }
      ]
    }
  ]
}

The text was updated successfully, but these errors were encountered:

kofj · 2020-12-01T15:38:35Z

@Clovel Hi,Clovel. Read document https://docs.docker.com/registry/spec/auth/token/ first pls.

If you want access the standard v2 APIs, you need retrive Bearer token from ${YOUR_HARBOR_DOMAIN}/service/token first. And then, add the Bearer token to your request's header.

Clovel · 2020-12-01T16:07:52Z

Thanks for the answer @kofj.

How come I can access other registries with Basic Auth but not Harbor's Docker registry ?

Also, I can't seem to get the Bearer Token :

$ curl -X GET -u user:password "https://ID.gra7.container-registry.ovh.net/service/token"
Unable to handle service:

This looks like something our sys admin should activate. Any clues ?

kofj · 2020-12-02T06:51:24Z

What's your harbro version?
If your harbor instance is new version and standard, you can use basic auth to access v2 API with baisc auth. e.g.

curl -v --basic -u admin:Harbor12345 ${YOUR_HARBOR_DOMAIN}/v2/_catalog

wy65701436 · 2020-12-07T05:17:48Z

@Clovel for the v2 api access, harbor supports both basci auth and bearer token.

For the basic, did you try the @kofj 's comments.
For the bearer token, you can just follow the docker reigstry document.

Clovel · 2020-12-07T11:07:15Z

Version

1. What's your harbro version?

Version v1.10.0-6b84b62f

Basic Auth

2. If your harbor instance is new version and standard, you can use basic auth to access v2 API with baisc auth. e.g.

curl -v --basic -u admin:Harbor12345 ${YOUR_HARBOR_DOMAIN}/v2/_catalog

This simply doesn't work, and results in

$ curl -v -X GET --basic -u <username>:<password> "https://<ID>.gra7.container-registry.ovh.net/v2/_catalog"
Note: Unnecessary use of -X or --request, GET is already inferred.
*   Trying <IP_ADDR>:443...
* TCP_NODELAY set
* Connected to <ID>.gra7.container-registry.ovh.net (<IP_ADDR>) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=*.gra7.container-registry.ovh.net
*  start date: Nov 12 00:00:00 2020 GMT
*  expire date: Nov 12 23:59:59 2021 GMT
*  subjectAltName: host "<ID>.gra7.container-registry.ovh.net" matched cert\'s "*.gra7.container-registry.ovh.net"
*  issuer: C=GB; ST=Greater Manchester; L=Salford; O=Sectigo Limited; CN=Sectigo RSA Domain Validation Secure Server CA
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Server auth using Basic with user '<username>'
* Using Stream ID: 1 (easy handle <?????>)
> GET /v2/_catalog HTTP/2
> Host: <ID>.gra7.container-registry.ovh.net
> authorization: Basic <B64_AUTH>
> user-agent: curl/7.68.0
> accept: */*
>
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 401
< date: Mon, 07 Dec 2020 11:04:13 GMT
< content-type: application/json; charset=utf-8
< content-length: 145
< docker-distribution-api-version: registry/2.0
< www-authenticate: Bearer realm="https://<ID>.gra7.container-registry.ovh.net/service/token",service="harbor-registry",scope="registry:catalog:*"
< x-content-type-options: nosniff
< strict-transport-security: max-age=15724800; includeSubDomains
< x-ovh-ingress: public-ingress
<
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}
* Connection #0 to host <ID>.gra7.container-registry.ovh.net left intact

It seems that Harbor is falling back to the Bearer token method and doesn't accept basic auth.

Clovel · 2021-01-05T07:44:35Z

Bumping the issue. Any ideas ?

Lanyujiex · 2021-03-17T11:03:51Z

hi,I met a same question,have you solve it now?

Clovel · 2021-03-18T11:09:32Z

hi,I met a same question,have you solve it now?

I'm sorry @Lanyujiex, I haven't. I switched from the OVH Docker registry provider to a self-hosted registry.

IsaackRasmussen · 2021-04-21T11:28:01Z

This is fixed in version 2.2.1 - I've just confirmed it.

stale · 2021-07-21T00:34:21Z

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

bmerry · 2021-09-29T08:25:00Z

It seems anonymous access still doesn't work without providing some authentication on the latest version (v2.3.3-a0a9ed8a). If I create a public image, then try to fetch a manifest, I get

{"errors":[{"code":"UNAUTHORIZED","message":"authorize header needed to send HEAD to repository: authorize header needed to send HEAD to repository"}]}

However, if I use basic auth with some random username and password (not corresponding to an actual user) then it is successful.

sify21 · 2022-03-22T11:09:27Z

@Clovel for the v2 api access, harbor supports both basci auth and bearer token.

For the basic, did you try the @kofj 's comments. For the bearer token, you can just follow the docker reigstry document.

Hi @wy65701436 I'm using Harbor v1.8.2-1c3a3d53 (sadly I don't have admin privileges and can't update it to a newer version), I tried to use bearer token. I can get a token using informations from Www-Authentication header, but using that token still gets me insufficient_scope error. Do you know how to get around it?

[root@dev /]#curl --request GET \
>   --url 'http://{harbor ip and port}/service/token?service=harbor-registry&scope=registry%3Acatalog%3A*'
{
  "token": "the token string",
  "expires_in": 1800,
  "issued_at": "2022-03-22T10:55:05Z"
}[root@dev  /]#curl --request GET \
>   --url http://{harbor ip and port}/v2/_catalog \
>   --header 'Authorization: Bearer {the token string}' -v
* About to connect() to {ip} port {port} (#0)
*   Trying {ip}...
* Connected to {ip} ({ip}) port {port} (#0)
> GET /v2/_catalog HTTP/1.1
> User-Agent: curl/7.29.0
> Host: {ip}:{port}
> Accept: */*
> Authorization: Bearer {token}
> 
< HTTP/1.1 401 Unauthorized
< Server: nginx
< Date: Tue, 22 Mar 2022 10:58:32 GMT
< Content-Type: application/json; charset=utf-8
< Content-Length: 145
< Connection: keep-alive
< Docker-Distribution-Api-Version: registry/2.0
< Set-Cookie: sid=cbc98d48e4aff437dac8165d0475aae4; Path=/; HttpOnly
< Www-Authenticate: Bearer realm="http://{harbor ip and port}/service/token",service="harbor-registry",scope="registry:catalog:*",error="insufficient_scope"
< 
{"errors":[{"code":"UNAUTHORIZED","message":"authentication required","detail":[{"Type":"registry","Class":"","Name":"catalog","Action":"*"}]}]}
* Connection #0 to host {ip} left intact

github-actions · 2022-07-06T09:17:58Z

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

bmerry · 2022-07-22T09:54:51Z

I've retested with 2.5.3 and it still doesn't allow anonymously fetching the manifest for a public image (while succeeding when made-up Basic auth credentials are given).

texano00 · 2022-08-04T15:49:48Z

Hi,
using Harbor v2.5.3, I created a system robot account using below API

POST {harbor-host}/api/v2.0/robots
{
   "name":"lorem",
   "duration":-1,
   "description":"",
   "disable":false,
   "level":"system",
   "permissions":[
      {
         "access": [
         {
            "action": "push",
            "resource": "repository"
         },
         {
            "action": "delete",
            "resource": "repository"
         },
         {
            "action": "read",
            "resource": "artifact"
         },
         {
            "action": "list",
            "resource": "artifact"
         },
         {
            "action": "delete",
            "resource": "artifact"
         },
         {
            "action": "create",
            "resource": "artifact-label"
         },
         {
            "action": "delete",
            "resource": "artifact-label"
         },
         {
            "action": "list",
            "resource": "repository"
         },
         {
            "action": "create",
            "resource": "tag"
         },
         {
            "action": "delete",
            "resource": "tag"
         },
         {
            "action": "list",
            "resource": "tag"
         },
         {
            "action": "create",
            "resource": "scan"
         },
         {
            "action": "stop",
            "resource": "scan"
         },
         {
            "action": "read",
            "resource": "helm-chart"
         },
         {
            "action": "create",
            "resource": "helm-chart-version"
         },
         {
            "action": "delete",
            "resource": "helm-chart-version"
         },
         {
            "action": "create",
            "resource": "helm-chart-version-label"
         },
         {
            "action": "delete",
            "resource": "helm-chart-version-label"
         },
         {
            "action": "pull",
            "resource": "repository"
         }
         ],
         "kind": "project",
         "namespace": "*"
      },
      {
         "kind":"system",
         "namespace":"/",
         "access":[
            {
               "resource":"catalog",
               "action":"read"
            }
         ]
      }
   ]
}

With this robot I was able to call "GET {harbor-host}/v2/_catalog" successfully BUT trying to call
"GET {harbor-host}/v2/{project}/{repo}/tags/list" I'm receiving

Get "{harbor-host}/v2/{project}/{repo}/tags/list": http: non-successful response (status=401 body="{"errors":[{"code":"UNAUTHORIZED","message":"unauthorized to access repository: {project}/{repo}, action: pull: unauthorized to access repository: {project}/{repo}, action: pull"}]}\n")

I think this "if" https://github.com/goharbor/harbor/blob/v2.5.3/src/server/middleware/v2auth/auth.go#L76 is returning "false" for some reason (unknown to me).

github-actions · 2022-10-04T09:06:50Z

This issue is being marked stale due to a period of inactivity. If this issue is still relevant, please comment or remove the stale label. Otherwise, this issue will close in 30 days.

github-actions · 2022-11-04T09:04:01Z

This issue was closed because it has been stalled for 30 days with no activity. If this issue is still relevant, please re-open a new issue.

embroede · 2022-12-12T23:17:48Z

I've retested with 2.5.3 and it still doesn't allow anonymously fetching the manifest for a public image (while succeeding when made-up Basic auth credentials are given).

I am also seeing this behavior. Is this seen as a non-issue by the maintainers?

ifofafk · 2023-04-21T08:58:58Z

i just had the same problem.
the Harbor version is "v2.8.0-89ef156d"

I have correct Harbor account and password, correct default-Registry account in "/opt/harbor/common/config/core/env".
How can I use Registry api just with account? For I'm trying docker-java.jar to do sth....

jpinkul · 2023-06-27T22:46:48Z

I think this "if" https://github.com/goharbor/harbor/blob/v2.5.3/src/server/middleware/v2auth/auth.go#L76 is returning "false" for some reason (unknown to me).

I found this else if was dropping the permissions:

			if len(sysPolicies) != 0 {
				evaluators = evaluators.Add(system.NewEvaluator(s.GetUsername(), sysPolicies))
			} else if len(proPolicies) != 0 {
				evaluators = evaluators.Add(rbac_project.NewEvaluator(s.ctl, rbac_project.NewBuilderForPolicies(s.GetUsername(), proPolicies)))
			}

I tried changing the else if to just an if and was successfully able to add both project level and system level permissions to the same robot account.

hummelm · 2024-10-23T09:53:19Z

Same issue here (Harbor v2.7.4):
With a system robot account :
I am able to call "GET {harbor-host}/v2/_catalog" successfully BUT trying to call
"GET {harbor-host}/v2/{project}/{repo}/tags/list" I'm receiving

Get "{harbor-host}/v2/{project}/{repo}/tags/list": http: non-successful response (status=401 body="{"errors":[{"code":"UNAUTHORIZED","message":"unauthorized to access repository: {project}/{repo}, action: pull: unauthorized to access repository: {project}/{repo}, action: pull"}]}\n")

krab-skunk · 2024-10-23T11:14:14Z

Its funny but i just noticed this error today too
Running harbor v2.9.3-f65d2380

For dockerhub, we use basic auth , yet we get authorize header needed to send HEAD to repository: authorize header needed to send HEAD to repository

kofj added the help wanted The issues that is valid but needs help from community label Dec 1, 2020

wy65701436 added the more-info-needed The issue author need to provide more details and context to the issue label Dec 7, 2020

karolz-ms mentioned this issue Apr 28, 2021

Error: Cannot read property '0' of undefined microsoft/vscode-docker#2908

Closed

stale bot added the Stale label Jul 21, 2021

stale bot removed the Stale label Sep 29, 2021

github-actions bot added the Stale label Jul 6, 2022

github-actions bot removed the Stale label Jul 23, 2022

texano00 mentioned this issue Aug 5, 2022

Users must be Harbor admins to query docker registry catalog (v2/_catalog) #6784

Closed

github-actions bot added the Stale label Oct 4, 2022

github-actions bot closed this as not planned Won't fix, can't repro, duplicate, stale Nov 4, 2022

sidewinder12s mentioned this issue Jun 7, 2023

Added proposal for enabling full api access to robot accounts through ui goharbor/community#223

Open

fbuchmeier-abi mentioned this issue Oct 24, 2023

Private registry authentication error ckotzbauer/sbom-operator#486

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Can't use Docker Registry V2 HTTPS API w/ Harbor Registry. #13653

Can't use Docker Registry V2 HTTPS API w/ Harbor Registry. #13653

Clovel commented Dec 1, 2020

kofj commented Dec 1, 2020

Clovel commented Dec 1, 2020 •

edited

Loading

kofj commented Dec 2, 2020

wy65701436 commented Dec 7, 2020

Clovel commented Dec 7, 2020 •

edited

Loading

Clovel commented Jan 5, 2021

Lanyujiex commented Mar 17, 2021

Clovel commented Mar 18, 2021 •

edited

Loading

IsaackRasmussen commented Apr 21, 2021

stale bot commented Jul 21, 2021

bmerry commented Sep 29, 2021

sify21 commented Mar 22, 2022 •

edited

Loading

github-actions bot commented Jul 6, 2022

bmerry commented Jul 22, 2022

texano00 commented Aug 4, 2022 •

edited

Loading

github-actions bot commented Oct 4, 2022

github-actions bot commented Nov 4, 2022

embroede commented Dec 12, 2022

ifofafk commented Apr 21, 2023

jpinkul commented Jun 27, 2023

hummelm commented Oct 23, 2024 •

edited

Loading

krab-skunk commented Oct 23, 2024 •

edited

Loading

Can't use Docker Registry V2 HTTPS API w/ Harbor Registry. #13653

Can't use Docker Registry V2 HTTPS API w/ Harbor Registry. #13653

Comments

Clovel commented Dec 1, 2020

Issue

More results

kofj commented Dec 1, 2020

Clovel commented Dec 1, 2020 • edited Loading

kofj commented Dec 2, 2020

wy65701436 commented Dec 7, 2020

Clovel commented Dec 7, 2020 • edited Loading

Version

Basic Auth

Clovel commented Jan 5, 2021

Lanyujiex commented Mar 17, 2021

Clovel commented Mar 18, 2021 • edited Loading

IsaackRasmussen commented Apr 21, 2021

stale bot commented Jul 21, 2021

bmerry commented Sep 29, 2021

sify21 commented Mar 22, 2022 • edited Loading

github-actions bot commented Jul 6, 2022

bmerry commented Jul 22, 2022

texano00 commented Aug 4, 2022 • edited Loading

github-actions bot commented Oct 4, 2022

github-actions bot commented Nov 4, 2022

embroede commented Dec 12, 2022

ifofafk commented Apr 21, 2023

jpinkul commented Jun 27, 2023

hummelm commented Oct 23, 2024 • edited Loading

krab-skunk commented Oct 23, 2024 • edited Loading

Clovel commented Dec 1, 2020 •

edited

Loading

Clovel commented Dec 7, 2020 •

edited

Loading

Clovel commented Mar 18, 2021 •

edited

Loading

sify21 commented Mar 22, 2022 •

edited

Loading

texano00 commented Aug 4, 2022 •

edited

Loading

hummelm commented Oct 23, 2024 •

edited

Loading

krab-skunk commented Oct 23, 2024 •

edited

Loading