Configuring ConfigAuth for OIDC does not work

[tschlaepfer]

Hi All, thanks for creating the provider.

When I was testing the provider I noticed that the ConfigAuth is not working if you apply it in the oidc_auth mode. I apply my the Kubernetes manifests with ArgoCD, which returns the health status as displayed in the screenshot below.

Comparing the "Desired" and "Live" manifest I noticed that for some reason in the live manifest the following three LDAP configurations where automatically added, causing the error.

- ldapGroupMembership: memberof
- ldapGroupScope: subtree
- ldapScope: subtree

Here some screenshots of the desired and live manifests from ArgoCD.

[lornest]

Hey @tschlaepfer. Thanks for raising the issue. Let me take a look at this and get back to you.

[tschlaepfer]

@lornest Today I had a quick look at the Terraform provider for Harbor and I think I found the root cause of this issue. In the provider, default values are set for the three LDAP parameters in the config_auth resource. https://github.com/goharbor/terraform-provider-harbor/blob/main/provider/resource_config_auth.go

[lornest]

Thanks @tschlaepfer - will keep an eye on the issue on the TF provider and react accordingly!

[BillyMichael]

If the terraform provider defaults these values, isn't it reasonable to also set them in the crossplane provider code @lornest ?

@tschlaepfer , do you explicitly want these values to remain unset? What consequences would arise if they were set by default?

[simonostendorf]

I have the same error, is there a timeline to fix this?

[lornest]

Will take a look at this @simonostendorf and figure out the right place to fix it - here or the TF provider. Will get back to you soon

[spacepants]

FYI, the underlying issue in the TF provider has just been resolved upstream, if you want to keep an eye out for the next release.

[theodor-franke]

can we update the terraform used? has anyone a workaround?

[lornest]

Sure. Will take a look at bumping TF version this weekend!

…

On Fri, 11 Jul 2025 at 13:54, Theodor Franke ***@***.***> wrote: *theodor-franke* left a comment (globallogicuki/provider-harbor#3) <#3 (comment)> can we update the terraform used? has anyone a workaround? — Reply to this email directly, view it on GitHub <#3 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACVNSO6ZALKNZAHZKMIRWHD3H6XZLAVCNFSM6AAAAABLKLBYQOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTANRSGIZDSOBSGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[raweber42]

Happy to contribute here if needed, @lornest :)