We are facing the same problems (with Jenkins 1.424.6 and Active Directory Plugin 1.29) and are interested in an error analysis or even a solution. The stack trace displayed in the Authorization Strategy table is:

Caused by: javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece]; remaining name 'DC=***,DC=***,DC=***'
	at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
	at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source)
	at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
	at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
	at hudson.plugins.active_directory.LDAPSearchBuilder.search(LDAPSearchBuilder.java:52)
	at hudson.plugins.active_directory.LDAPSearchBuilder.searchOne(LDAPSearchBuilder.java:42)
	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:260)
	... 66 more

I am also wondering why the class ActiveDirectoryUnixAuthenticationProvider is invoked although we are running on a Windows system.

I am asking who to assign issues related to the Active Directory plugin as the automatic assignment is Unassigned

We also see a flavor of this error. Jenkins 1.466.1, Active Directory plugin 1.29, CentOS 5.6. I think we also had it under the covers in our prior combination (1.448 / 1.24), it was just less obvious because the "Failed to test the validity of the user name" message didn't show in the UI. We are also using Project-based Matrix Authorization Strategy.

Caused by: javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece]; remaining name 'DC=copyright,DC=com'

We also see this error. We are running Jenkins 1.466.1 LTS with Active Directory authentication, on Centos 5.8. The authentication has been working correctly, but today I noticed the following type of error in:

Manage Jenkins > Configure System > Authorization > Project-based Matrix Authorization Strategy:

Failed to test the validity of the user name <myname> (show details)
org.acegisecurity.BadCredentialsException: Failed to retrieve user information for <myname>; nested exception is javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece

I clicked ‘Test’ underneath ‘Active Directory’ and it gave an error. I then downgraded the Active Directory plugin from 1.29 to 1.19. ‘Test’ now succeeds but the ‘Project-based Matrix Authorization Strategy’ area still shows the above error against each user.

See also Jenkins-12619

Also see this error when using Basic authentication with API tokens.
Every other requests gives the same LDAP error (i.e. #1 fails, #2 is fine, #3 fails, etc.)

Jenkins 1.500, ADPlugin 1.30

I'm having the same issue with Jenkins 1.489, and LDAP Plugin 1.2.

Still hoping for a fix for this bug.

David

If you see ActiveDirectoryUnixAuthenticationProvider in stack trace on Windows, that's because you are running earlier version of the AD plugin that does not support ADSI auth for 64bit Windows.

Also, when you report a stack trace, please do not truncate the stack trace. We need not just the error message but the stack frames leading up to it, including all the nested stack traces.

If you are worried that the lengthy text will make the issue hard to look at, please use attachments.

The error is because your AD does not allow anonymous bind, and therefore we cannot validate names of the other users. I believe specifying the bind DN and password will solve this problem.

>>>The error is because your AD does not allow anonymous bind, and therefore we cannot validate names of the other users. I believe specifying the bind DN and password will solve this problem.

Where does one specify a bind user and password? The only options I see under Advanced are "Domain Name" and "Domain controller".

Attached complete stack trace of error message

>>The error is because your AD does not allow anonymous bind
How does that account for the observation that the calls fail and succeed in alternation?

Have confirmed that with plugin version 1.33 and a Bind DN set this does work.
However, the domain controller does allow anonymous binds, so there's still a bug here.