Red Hat Quay LDAP authentication fails with "Operation vetoed by object creation policy" or "Code(-8017)"

Solution Verified - Updated -

Issue

  • An LDAP user is unable to log in to the Red Hat Quay registry, resulting in a silent login drop in the user interface (UI) without producing a valid session token.
  • The login issue is isolated to a specific user; other users configured under the same external LDAP group can log in without issues.
  • When Red Hat Quay debug flags (DEBUGLOG and USERS_DEBUG) are active, logs confirm the application successfully executes the LDAP query and identifies the user's Distinguished Name (DN), but terminates password validation with a directory-side veto error:
    Found matching DNs: ['cn=<username>,ou=<users>,o=<organization>']
    Found user for LDAP username <username>; validating password
    Operation vetoed by object creation policy.', b'<hex-transaction-id>Code(-8017) Operation vetoed by object creation policy.

Environment

  • Red Hat Quay 3.x (All Versions)
  • External LDAP / Active Directory (AD) authentication
  • Identity Provider: NetIQ eDirectory, Novell eDirectory, or other LDAP servers utilizing active password or intruder lockout policies

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content