Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-11990

After updating Active Directory plugin the Jenkins People database is experiencing massive performance issues synching because it is trying to authenticate users that are no longer in company Active Directory but are part of the Jenkins Database

XMLWordPrintable

      After the issues with the 1.23 identified here https://issues.jenkins-ci.org/browse/JENKINS-11720 and upgrading to 1.23 I am experiencing serious performance problems because the Jenkins internal database contains users that are no longer part of the company active directory and the system is trying to validate all the users. It now takes the "People" page over 10 mins to load every time it is clicked. Attempts to go there produce the following error:

      Dec 5, 2011 2:09:37 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser
      WARNING: Exhausted all configured domains and could not authenticate against any.
      Dec 5, 2011 2:09:37 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser
      WARNING: Credential exception tying to authenticate against xxxxxxxxxxx domain
      hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)
      at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)
      at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)
      at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)
      at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)
      at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)
      at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)
      at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)
      at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)
      at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)
      at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:692)
      at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:667)
      at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:645)
      at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)
      at hudson.model.Run.run(Run.java:1448)
      at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)
      at hudson.model.ResourceController.execute(ResourceController.java:88)
      at hudson.model.Executor.run(Executor.java:230)

      I have removed the company's domain name and replaced it with the xxxxxxxx entry in the error message for obvious reasons. Not sure if these users that no longer are part of the active directory can just be deleted without causing other issues/problems. Jenkis display information is maintained in this People database so it is needed. Not sure if deleting members no longer in AD will cause Jenkins to have display issues or other problems.

      It was nice to be able to use the Jenkins internal People Database to configure the display of users which when using active directory only show as numerical IDs. It seems that this capability is now lost because of the new AD plug-in.

      NEW SIDE EFFECT:

      I am seeing an additional issue I believe is related to this problem. A job will build successfully but never complete as the system continues to try and validate the person that checked in the code and fails:

      WARNING: RegExMailAddressResolver configuration for regex null and email pattern null is not valid.
      Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser
      WARNING: Credential exception tying to authenticate against xxxxxxx domain
      hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)
      at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)
      at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)
      at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)
      at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)
      at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)
      at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)
      at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)
      at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)
      at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)
      at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:697)
      at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:672)
      at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:650)
      at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)
      at hudson.model.Run.run(Run.java:1448)
      at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)
      at hudson.model.ResourceController.execute(ResourceController.java:88)
      at hudson.model.Executor.run(Executor.java:238)
      Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser
      WARNING: Credential exception tying to authenticate against xxxxxxxxx domain
      hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)
      at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)
      at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)
      at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)
      at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)
      at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)
      at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)
      at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)
      at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)
      at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)
      at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)
      at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:697)
      at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:672)
      at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:650)
      at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)
      at hudson.model.Run.run(Run.java:1448)
      at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)
      at hudson.model.ResourceController.execute(ResourceController.java:88)
      at hudson.model.Executor.run(Executor.java:238)
      Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

      I have to restart Jenkins to clear out the locked job because it blocks any other jobs from running.

        1. Thread Dump5.doc
          322 kB
          alexlombardi
        2. Thread Dump4.doc
          308 kB
          alexlombardi
        3. Thread Dump3.doc
          296 kB
          alexlombardi
        4. Thread Dump2.doc
          254 kB
          alexlombardi
        5. Thread Dump1.doc
          263 kB
          alexlombardi

            Unassigned Unassigned
            alexlombardi alexlombardi
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: