Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-13159

Active Directory plugin v1.20 and Jenkins v1.456 allows passwordless authentication

XMLWordPrintable

      When using v1.20 of the Active Directory plugin and the latest version of Jenkins (v1.456 as of submission of this bug report) Jenkins allows for password-less authentication.

      I realize that v1.20 is an old version of the plugin but many users (including myself) are not upgrading to the latest version due to known bugs with group based LDAP/AD authentication.

      We should put a message/disclaimer on the Active Directory wiki page stating that users should upgrade to the latest version to avoid this issue.

          [JENKINS-13159] Active Directory plugin v1.20 and Jenkins v1.456 allows passwordless authentication

          Kohsuke Kawaguchi added a comment -

          There's already security advisory issued for the AD plugin https://groups.google.com/forum/?fromgroups#!topic/jenkinsci-advisories/9XCq0hd0kgo

          Kohsuke Kawaguchi added a comment - There's already security advisory issued for the AD plugin https://groups.google.com/forum/?fromgroups#!topic/jenkinsci-advisories/9XCq0hd0kgo

            Unassigned Unassigned
            buildscientist Youssuf ElKalay
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: