Change robot account secret through API

[niltongouveajr]

Hello!

Is it possible to set a robot account's secret through the API? I couldn't do this either at the time of account creation or change it after creation.

curl -s -k -X POST "${HARBOR_API_URL}/robots" -H "accept: application/json" -H "authorization: Basic ${HARBOR_API_TOKEN}" -H "Content-Type: application/json" -d "{ \"name\": \"${HARBOR_ROBOT_USER}\", \"secret\": \"${HARBOR_ROBOT_SECRET}\", \"disable\": false, \"level\": \"system\", \"duration\": -1, \"permissions\": [ { \"access\": [ { \"action\": \"create\", \"resource\": \"scan\" }, { \"action\": \"push\", \"resource\": \"repository\" }, { \"action\": \"pull\", \"resource\": \"repository\" }, { \"action\": \"delete\", \"resource\": \"artifact\" }, { \"action\": \"read\", \"resource\": \"helm-chart\" }, { \"action\": \"create\", \"resource\": \"helm-chart-version\" }, { \"action\": \"delete\", \"resource\": \"helm-chart-version\" }, { \"action\": \"create\", \"resource\": \"tag\" }, { \"action\": \"delete\", \"resource\": \"tag\" }, { \"action\": \"create\", \"resource\": \"artifact-label\" } ], \"kind\": \"project\", \"namespace\": \"${HARBOR_ROBOT_PROJECT}\" } ]}"

curl -s -k -X PUT "${HARBOR_API_URL}/robots/${HARBOR_ROBOT_ID}" -H "accept: application/json" -H "authorization: Basic ${HARBOR_API_TOKEN}" -H "Content-Type: application/json" -d "{ \"secret\": \"${HARBOR_ROBOT_SECRET}\" }"

I thought about trying to change the secret directly in the database but I believe this is not the best way.

Best regards,
Nilton

[ussu]

Hi,
I am facing a similar issue :)
I didn't manage to set the robot account secret at creation in the POST request, I was able to update the secret after the creation with the PUT request though.

If I am not mistaken, the documentation indeed states secret as a valid parameter for the POST /robots route.

I am not familiar with the codebase but it seems the controller

harbor/src/controller/robot/controller.go

Line 96 in 8fb7668

secret := utils.Encrypt(pwd, salt, utils.SHA256)

overwrites the parameter with a generated secret?

Running Version v2.2.2-56d7937f

[niltongouveajr]

Hi @ussu

You cannot set a secret at the robot user creation. But you can refresh it later with PATCH endpoint:

curl -s -k -X PATCH "${HARBOR_API_URL}/robots/${HARBOR_ROBOT_ID}" -H "accept: application/json" -H "authorization: Basic ${HARBOR_API_TOKEN}" -H "Content-Type: application/json" -d "{ \"secret\": \"${HARBOR_ROBOT_SECRET}\" }"

#15268

I didn't notice this when I read the API documentation. Hope this helps.

BR,
Nilton

[ussu]

Thanks I didn't see there was also an issue :)

[wy65701436]

This is can be closed per issue #15268 (comment)