Proposal: Personal Access Tokens (PAT)

Closed
RO
4mo ago
+198-0

Summary

Proposes Personal Access Tokens (PAT) as a modern, self-service authentication mechanism for Harbor. PATs provide named, time-limited credentials with audit trails, enabling secure CI/CD integration and programmatic access.

Features

  • Self-service token management: Users create, list, update, and delete their own tokens
  • Time-limited credentials: Configurable expiration (days or never-expire)
  • Audit trail: Track token creation, updates, and usage via last_used_at
  • Scoped permissions: Project-level scope enforcement
  • Secure hashing: PBKDF2-SHA256 with per-token salt
  • Backward compatible: Automatic migration of legacy OIDC CLI secrets

Related Work

  • Implementation PR: goharbor/harbor#23370
  • Token format: hbr_pat_ + 32-character random secret
  • Replaces legacy CLI token system with modern alternatives