When Harbor is integrated with AD users may be onboarded with a particular LDAP setting. If the existing user account is moved to a different LDAP setting with the same email attribute, the user won't be able to login.
Example:
There is a user defined as ldap_uid=uid0001,cn=mike,email=[email protected]. This user is able to login as "mike" as it is configured to use ldap_uid field to "cn". If any setting is changed, like changing the domain or changing the UID attribute from "cn" to "samAccountName" subsequent logins as "mike" will fail. This is because there is a user existing in the harbor_user table in the Harbor database with the same email, [email protected].