On Hudson 1.180 inside Tomcat 6.0.14 (running as an application as a logged in
user on the domain, not as a service):
If I configure hudson to use active directory authentication (active-directory
1.1 plugin + matrix-based security...after a few logins/logouts, when
attempting to log in I will begin getting StringOutOfBoundsExceptions from
Tomcat.

Note that I am also witnessing this same issue on another of my Hudson machines
on Hudson 1.177 / Tomcat 5.5, using
Hudson's own user database + matrix-based security, so I don't think it is
specific to a given authentication method, except that it's when hudson handles
it.

Here is the full stacktrace given in the Tomcat logs:

Feb 9, 2008 12:03:56 AM org.apache.catalina.core.StandardWrapperValve invoke
SEVERE: Servlet.service() for servlet Stapler threw exception
java.lang.StringIndexOutOfBoundsException: String index out of range: -7
at java.lang.String.substring(String.java:1768)
at java.lang.String.substring(String.java:1735)
at hudson.security.AuthenticationProcessingFilter2.determineTargetUrl
(AuthenticationProcessingFilter2.java:27)
at
org.acegisecurity.ui.AbstractProcessingFilter.successfulAuthentication
(AbstractProcessingFilter.java:480)
at org.acegisecurity.ui.AbstractProcessingFilter.doFilter
(AbstractProcessingFilter.java:266)
at hudson.security.ChainedServletFilter$1.doFilter
(ChainedServletFilter.java:55)
at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter
(RememberMeProcessingFilter.java:135)
at hudson.security.ChainedServletFilter$1.doFilter
(ChainedServletFilter.java:55)
at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter
(BasicProcessingFilter.java:173)
at hudson.security.ChainedServletFilter$1.doFilter
(ChainedServletFilter.java:55)
at
org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter
(HttpSessionContextIntegrationFilter.java:249)
at hudson.security.ChainedServletFilter$1.doFilter
(ChainedServletFilter.java:55)
at hudson.security.ChainedServletFilter.doFilter
(ChainedServletFilter.java:44)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:85)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter
(ApplicationFilterChain.java:235)
at org.apache.catalina.core.ApplicationFilterChain.doFilter
(ApplicationFilterChain.java:206)
at org.apache.catalina.core.StandardWrapperValve.invoke
(StandardWrapperValve.java:233)
at org.apache.catalina.core.StandardContextValve.invoke
(StandardContextValve.java:175)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke
(AuthenticatorBase.java:433)
at org.apache.catalina.core.StandardHostValve.invoke
(StandardHostValve.java:128)
at org.apache.catalina.valves.ErrorReportValve.invoke
(ErrorReportValve.java:102)
at org.apache.catalina.core.StandardEngineValve.invoke
(StandardEngineValve.java:109)
at org.apache.catalina.connector.CoyoteAdapter.service
(CoyoteAdapter.java:263)
at org.apache.coyote.http11.Http11AprProcessor.process
(Http11AprProcessor.java:852)
at org.apache.coyote.http11.Http11AprProtocol
$Http11ConnectionHandler.process(Http11AprProtocol.java:584)
at org.apache.tomcat.util.net.AprEndpoint$Worker.run
(AprEndpoint.java:1508)
at java.lang.Thread.run(Thread.java:595)

In both cases it's the same out of range value (-7)