Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-14057

With Active Directory Plugin, the user/group validation in authorization strategy of configuration screen fails

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • active-directory-plugin
    • None
    • Win Server 2008, AIX, AD plugin version=1.26, Jenkins version=1.424.6

      Using the Project-based Matrix Authorization Strategy the identification of the usernames doesn't work properly. Sometimes the username is recognized, sometimes the user fullname is recognized, sometimes nor the username neither the full name are recognized.

      It worked in old versions of jenkins and the plugin (1.16).

      The errormessage is:
      org.acegisecurity.BadCredentialsException: Failed to retrieve user information for xyz; nested exception is javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece

        1. Stacktrace1.txt
          7 kB

          [JENKINS-14057] With Active Directory Plugin, the user/group validation in authorization strategy of configuration screen fails

          Thorsten Löber created issue -

          Stefan added a comment - - edited

          We are facing the same problems (with Jenkins 1.424.6 and Active Directory Plugin 1.29) and are interested in an error analysis or even a solution. The stack trace displayed in the Authorization Strategy table is:

          Caused by: javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece]; remaining name 'DC=***,DC=***,DC=***'
	at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
	at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source)
	at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source)
	at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
	at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source)
	at hudson.plugins.active_directory.LDAPSearchBuilder.search(LDAPSearchBuilder.java:52)
	at hudson.plugins.active_directory.LDAPSearchBuilder.searchOne(LDAPSearchBuilder.java:42)
	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:260)
	... 66 more

          Stefan added a comment - - edited We are facing the same problems (with Jenkins 1.424.6 and Active Directory Plugin 1.29) and are interested in an error analysis or even a solution. The stack trace displayed in the Authorization Strategy table is: Caused by: javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece]; remaining name 'DC=***,DC=***,DC=***' at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source) at com.sun.jndi.ldap.LdapCtx.searchAux(Unknown Source) at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) at com.sun.jndi.ldap.LdapCtx.c_search(Unknown Source) at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Unknown Source) at hudson.plugins.active_directory.LDAPSearchBuilder.search(LDAPSearchBuilder.java:52) at hudson.plugins.active_directory.LDAPSearchBuilder.searchOne(LDAPSearchBuilder.java:42) at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:260) ... 66 more
          Stefan made changes -
          Description Original: Using the Project-based Matrix Authorization Strategy the identification of the usernames doesn't work properly. Sometimes the username is recognized, sometimes the user fullname is recognized, sometimes nor the username neither the full name are recognized.

          It worked in old versions of jenkins and the plugin (1.16).


          The errormessage is:
          org.acegisecurity.BadCredentialsException: Failed to retrieve user information for xyz; nested exception is javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece           		New: Using the Project-based Matrix Authorization Strategy the identification of the usernames doesn't work properly. Sometimes the username is recognized, sometimes the user fullname is recognized, sometimes nor the username neither the full name are recognized.

          It worked in old versions of jenkins and the plugin (1.16).

          The errormessage is:
          org.acegisecurity.BadCredentialsException: Failed to retrieve user information for xyz; nested exception is javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece
          Summary Original: Active Directory Plugin doesn't work anymore New: Active Directory Plugin doesn't work anymore (user/group identification in authorization strategy fails)
          Stefan made changes -
          Environment Original: Win Server 2008, AIX New: Win Server 2008, AIX, AD plugin version=1.26, Jenkins version=1.424.6

          Stefan added a comment -

          I am also wondering why the class ActiveDirectoryUnixAuthenticationProvider is invoked although we are running on a Windows system.

          Stefan added a comment - I am also wondering why the class ActiveDirectoryUnixAuthenticationProvider is invoked although we are running on a Windows system.

          Stefan added a comment -

          I am asking who to assign issues related to the Active Directory plugin as the automatic assignment is Unassigned

          Stefan added a comment - I am asking who to assign issues related to the Active Directory plugin as the automatic assignment is Unassigned
          Stefan made changes -
          Assignee New: Kohsuke Kawaguchi [ kktest11 ]
          Stefan made changes -
          Summary Original: Active Directory Plugin doesn't work anymore (user/group identification in authorization strategy fails) New: With Active Directory Plugin, the user/group validation in authorization strategy of configuration screen fails

          Dan Stine added a comment - - edited

          We also see a flavor of this error. Jenkins 1.466.1, Active Directory plugin 1.29, CentOS 5.6. I think we also had it under the covers in our prior combination (1.448 / 1.24), it was just less obvious because the "Failed to test the validity of the user name" message didn't show in the UI. We are also using Project-based Matrix Authorization Strategy.

          Caused by: javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece]; remaining name 'DC=copyright,DC=com'

          Dan Stine added a comment - - edited We also see a flavor of this error. Jenkins 1.466.1, Active Directory plugin 1.29, CentOS 5.6. I think we also had it under the covers in our prior combination (1.448 / 1.24), it was just less obvious because the "Failed to test the validity of the user name" message didn't show in the UI. We are also using Project-based Matrix Authorization Strategy. Caused by: javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece]; remaining name 'DC=copyright,DC=com'

          David Aldrich added a comment - - edited

          We also see this error. We are running Jenkins 1.466.1 LTS with Active Directory authentication, on Centos 5.8. The authentication has been working correctly, but today I noticed the following type of error in:

          Manage Jenkins > Configure System > Authorization > Project-based Matrix Authorization Strategy:

          Failed to test the validity of the user name <myname> (show details)
org.acegisecurity.BadCredentialsException: Failed to retrieve user information for <myname>; nested exception is javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece

          I clicked ‘Test’ underneath ‘Active Directory’ and it gave an error. I then downgraded the Active Directory plugin from 1.29 to 1.19. ‘Test’ now succeeds but the ‘Project-based Matrix Authorization Strategy’ area still shows the above error against each user.

          David Aldrich added a comment - - edited We also see this error. We are running Jenkins 1.466.1 LTS with Active Directory authentication, on Centos 5.8. The authentication has been working correctly, but today I noticed the following type of error in: Manage Jenkins > Configure System > Authorization > Project-based Matrix Authorization Strategy: Failed to test the validity of the user name <myname> (show details) org.acegisecurity.BadCredentialsException: Failed to retrieve user information for <myname>; nested exception is javax.naming.NamingException: [LDAP: error code 1 - 00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece I clicked ‘Test’ underneath ‘Active Directory’ and it gave an error. I then downgraded the Active Directory plugin from 1.29 to 1.19. ‘Test’ now succeeds but the ‘Project-based Matrix Authorization Strategy’ area still shows the above error against each user.

            kktest11 Kohsuke Kawaguchi
            lot Thorsten Löber
            Votes:
            13 Vote for this issue
            Watchers:
            18 Start watching this issue

              Created:
              Updated: