Logging in OIDC user via harbor/keycloak api

[maheshsmartcow]

Hi, I am not sure there is a solution for below scenario already, I couldn't find one yet.

1. Integrated KeyCloak as OIDC provider and created dedicated realm and client for harbor
2. Created a user in Keycloak for harbor client

Requirement is I need to upload a predefined CLI secret for the new user for docker login. Looks like until I login into harbor UI via OIDC, user is not created in harbor.

I can go to harbor UI and login via OIDC with new user but I cannot do that because I am trying to achieve this through automation (api calls). Is there any setting or option to achieve my requirement ?

[Vad1mo]

You can onboard the user via the API.

1. Enable Automatic onboarding in Harbor OIDC config
2. Onboard user by calling /c/oidc/onboard from your API

For Reference see this code:
See this code https://github.com/goharbor/harbor/blob/main/src/core/controllers/oidc.go#L73

[maheshsmartcow]

I enabled, Automatic onboarding with preferred_username in the config but it lets to consider username when user tries to login manually via UI. and I believe there is a open issue on /c/oidc/onboard api call which is #16967

[Vad1mo]

#16967 is not relevant, more a convenience.

[maheshsmartcow]

Apologies for checking again, I am trying to hit /c/oidc/onboard endpoint with --data-raw '{"username": "test1"}', I am still getting whatever the error stated in above ticket {"errors":[{"code":"FORBIDDEN","message":"CSRF token invalid"}]}. Appreciate if you can share any working sample or docs to refer.

[Vad1mo]

Get a valid CSRF token first. with some get request.

[maheshsmartcow]

I tried to get CSRF token by https://****/c/oidc/login end point and below is the response

content-length: 324
content-type: text/html; charset=utf-8
date: Tue, 21 Jun 2022 12:48:38 GMT
location: https://****/auth/realms/harbor/protocol/openid-connect/auth?client_id=harbor&redirect_uri=https%3A%2F%****%2Fc%2Foidc%2Fcallback&response_type=code&scope=openid+profile+email+offline_access&state=atqNH5b1vmqjfJF2czVYYQ2OxucB5WQi
vary: Cookie
x-harbor-csrf-token: tEQii7l5zrvWrVv8Mqnflv12zTXAh+52q7ShuiPXMku2LegIFu3JJMJ/P4MjyyXjKMcpN4EL/QKZd1xPUxfSNg==
x-request-id: 02d30eef-b734-4df7-ba42-f3cab6318d12

but onboarding request is not successful with x-harbor-csrf-token which I assume is the csrf token from GET request. I am not sure I am following you correct. Please advise. Thanks