Harbor Token Expiration (Minutes) setting

[ep4sh]

Dear community,
could you please explain some features regarding token lifetime with OIDC.

I use OIDC (keycloak) and harbor (works perfectly, btw).

My token expiration is 360min, but it looks like the token is being expired earlier than the desired timeframe.
I guess it could depend on OIDC parameter like refresh token, isn't it?

thanks in advance,
P.

[wy65701436]

the token expiration is for the distribution v2 api token to pull artifacts, and the second session timeout is for the harbor UI session timeout.

Can you explain the issue that you have in details?

[ep4sh]

Sure, as you can see, I set up 360 minutes for token expiration, unfortunately, I'm getting unauthorized error for docker CLI (approximately) every 50–60 minutes. Then I have to open harbor UI, logout, login with Keycloak, exec docker login.

I just want to perform those operations once a day (let's say once in 360m).

If you're curious about versions:

• harbor v2.12.2
• Docker version 27.5.1, build 9f9e405801

Thanks!

[fangzhengjin]

same problem

[ep4sh]

My guess is that when the token is being created here (from user config):

• /~https://github.com/goharbor/harbor/blob/main/src/core/service/token/authutils.go#L118
  But unfortunately, user config loading is missing:
• /~https://github.com/goharbor/harbor/blob/main/src/lib/config/userconfig.go#L94

So the default config (DefaultMgr) was used. I've also created a draft PR for it, please check.

Thanks, P.