#1 Proposal: Personal Access Tokens (PAT)

Summary

Proposes Personal Access Tokens (PAT) as a modern, self-service authentication mechanism for Harbor. PATs provide named, time-limited credentials with audit trails, enabling secure CI/CD integration and programmatic access.

Features

• Self-service token management: Users create, list, update, and delete their own tokens
• Time-limited credentials: Configurable expiration (days or never-expire)
• Audit trail: Track token creation, updates, and usage via last_used_at
• Scoped permissions: Project-level scope enforcement
• Secure hashing: PBKDF2-SHA256 with per-token salt
• Backward compatible: Automatic migration of legacy OIDC CLI secrets

Related Work

• Upstream proposal: goharbor/community#287
• Implementation PR: container-registry/harbor-next#495
• Token format: hbr_pat_ + 32-character random secret
• Replaces legacy CLI token system with modern alternatives

---

Summary by cubic

Adds a proposal for Personal Access Tokens (PAT) that enable self-service, time-limited, auditable credentials for Harbor’s API and Docker login via Basic Auth. Defines the hbr_pat_ token format, deny-by-default project scoping, versioned PBKDF2-SHA256 hashing (v1:sha256:100000:salt:hash) with configurable iterations, a personal_access_token table (with update_time trigger and secret VARCHAR(255)), clarified audit logging vs last_used_at, and legacy OIDC CLI secret migration on first use.