VCF 9.1 - Configuring Harbor to use VCF Identity Broker (IDB) for External Identity Federation

Similar to Configuring vSphere Supervisor to use VMware Cloud Foundation (VCF) Identity Broker (IDB) for external identity federation, Harbor also supports OpenID Connect (OIDC) identity providers (IdPs). This would allow Harbor or any components that support OIDC-based IdP to leverage our existing VCF IDB instance that is already integrated with VCF Single Sign-On (SSO), reducing the need to create an additional OIDC client configurations from the IdP itself.

Since I already had VCF Single Sign-On (SSO) configured with Keycloak using my VCF Infrastructure Services (VIS) Appliance Fling, it was easy for me to validate and demonstrate this integration after coming across a question about it this morning in one of our internal Google channels 🙂

Step 1 - Retrieve the Harbor Callback URL which you can find by logging into the Harbor Admin UI and navigate to Administration > Configuration > Authentication and choose OIDC and at the very bottom, you will see a URL that should look like following: https://vis.vcf.lab:9443/c/oidc/callback

Step 2 - Login to VCF Operations to create a new OIDC Client for Harbor by navigating to Manage >Fleet Management >Identity & Access >VCF SSO Overview >Other Components and click on Add Component.

Fill out the Name field with friendly label, select your Identity Broker, Redirect URL from Step 1 and then click on regenerate Client ID/Secret and make a note of Identity Broker Issuer URL along with the generated Client ID/Secret.

Step 3 - Go back to Harbor Admin UI and fill out following:

• OIDC Provider Name - This is the friendly label that will be displayed when logging into Harbor using OIDC IdP
• OIDC Endpoint - This is the Identity Broker Issuer URL that was retrieved from Step 2, make sure the URL includes trailing slash (e.g. https://vcf-idb02.vcf.lab/acs/t/CUSTOMER/) or you will run into validation issue
• OIDC Client ID - This is the generated Client ID from Step 2
• OIDC Client Secret - This is the generated Client Secret from Step 2
• Group Claim Name - This needs to have value group_names
• OIDC Admin Group - This is group name in your IdP
• OIDC Scope - This needs to have value openid,profile,email,offline_access,groups (no spaces between commas or Harbor UI will throw syntax error)
• Automatic Onboarding - Check this box since we need to enter username claim
• Username claim - This needs to have value acct

To validate that everything is setup correctly, you can click on the Test OIDC Server button and that should return green to confirm Harbor can connect to VCF IdB.

Step 5 - Open an incognito browser to Harbor and you should now see an option to login using VCF SSO via VCF IDB that is connected to your existing IdP.

Step 6 - Once you have successfully logged in with a valid user account, login to Harbor using the default admin account and assign the OIDC user the Administrator role. Otherwise, the user will have the default permission in Harbor.