Configure access control using OVHcloud IAM on an OVHcloud Managed Private Registry

Objective

OVHcloud Managed Private Registry (MPR) supports authentication through OVHcloud IAM, allowing you to manage access using centralized user identities and roles.

This guide explains how to enable IAM authentication and control user access to your registry using OVHcloud IAM users and roles.

Requirements

• An OVHcloud Managed Private Registry (see the creating a private registry guide for more information).
• An access to the Harbor UI to operate the private registry (see the connecting to the UI guide for more information).

Instructions

Introduction to OVHcloud IAM

OVHcloud IAM (Identity and Access Management) is a centralized system that lets you manage who can access your OVHcloud services and what they are allowed to do. It provides fine-grained access control through users, groups and roles.

When used with Managed Private Registry (MPR), OVHcloud IAM replaces Harbor’s local user database. This enables you to:

• use SSO (Single Sign-On) with your OVHcloud credentials to access Harbor.
• assign predefined IAM roles (admin, standard) to control access levels.
• manage permissions at scale using IAM groups and projects.

By integrating IAM with your registry, you ensure consistent access control across your OVHcloud services — reducing manual management and improving security.

Activate/disable authentication via OVHcloud IAM

Authentication using SSO with OVHcloud IAM users

Once IAM authentication is enabled, access to the Harbor UI is handled via OVHcloud Single Sign-On (SSO). Users no longer log in with Harbor-local credentials but authenticate directly using their OVHcloud IAM identity.

To log in via SSO:

• Open the Harbor user interface from the Control Panel.

• You will be redirected to the OVHcloud authentication page, log in using your OVHcloud IAM credentials.

• Access to Harbor is granted based on the IAM role associated with your user account.

Managing access rights with OVHcloud IAM

OVHcloud IAM provides two predefined roles for managing access to your Managed Private Registry (MPR):

• Standard
• Admin

These roles are assigned through IAM policies. To create and configure a policy, log in to the OVHcloud Control Panel and navigate to the Identity, Security & Operations section. Then, in the left-hand menu under Identity and Access management, click on Policies and click the Create a policy button.

Define users and groups, name your policy, add the users you want to include and optionally, add user groups if they have already been created.

Set permissions for MPR:

• In the Product types section, select Public Cloud Project/Managed Registry.
• In the Resources section, choose the specific MPR instance to which the policy will apply.

Expand Public Cloud Project/Managed Registry and select the desired role for the users defined in the policy.

Go further

To go further you can look at our guides on:

• Managing users and projects.
• Creating and using a private image.