• Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • ldap-plugin
    • None
    • linux, jenkins 1.589, LDAP plugin 1.6, OpenJDK Runtime Environment (IcedTea6 1.12.6) (6b27-1.12.6-1ubuntu0.12.04.2), OpenJDK 64-Bit Server VM (build 20.0-b12, mixed mode)

      When settings user search base (see attachment), the LDAP plugin incorrect creates the DN for user lookup. For some reason, ou=People,dc=symbio,dc=com is still appended to the DN when it should replaced by the user search base and root DN.

      This can be clearly seen from the log message:

      Sep 6, 2013 8:41:09 AM org.acegisecurity.providers.ldap.authenticator.BindAuthenticator2 handleBindException
      WARNING: Failed to bind to LDAP: userDnldaps://xxxxxxxxxxxxx:636/uid=test.user,ou=People,dc=symbio,dc=com,ou=AU,ou=Views,dc=symbio,dc=com  username=lars.remes
      javax.naming.AuthenticationException: [LDAP: error code 32 - No Such Object]
      	at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:290)
      	at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2685)
      	at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:306)
      	at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)
      	at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
      	at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
      	at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
      	at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
      	at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
      	at javax.naming.InitialContext.init(InitialContext.java:240)
      	at javax.naming.InitialContext.<init>(InitialContext.java:214)
      	at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:99)
      	at org.acegisecurity.ldap.DefaultInitialDirContextFactory.connect(DefaultInitialDirContextFactory.java:180)
      	at org.acegisecurity.ldap.DefaultInitialDirContextFactory.newInitialDirContext(DefaultInitialDirContextFactory.java:261)
      	at org.acegisecurity.ldap.LdapTemplate.execute(LdapTemplate.java:123)
      	at org.acegisecurity.ldap.LdapTemplate.retrieveEntry(LdapTemplate.java:165)
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator.bindWithDn(BindAuthenticator.java:87)
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator.authenticate(BindAuthenticator.java:72)
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator2.authenticate(BindAuthenticator2.java:49)
      	at org.acegisecurity.providers.ldap.LdapAuthenticationProvider.retrieveUser(LdapAuthenticationProvider.java:233)
      	at org.acegisecurity.providers.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:122)
      	at org.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:200)
      	at org.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:47)
      	at org.acegisecurity.ui.webapp.AuthenticationProcessingFilter.attemptAuthentication(AuthenticationProcessingFilter.java:74)
      	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:252)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:174)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:64)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
      	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
      	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:46)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
      	at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:227)
      	at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
      	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
      	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
      	at java.util.concurrent.FutureTask.run(FutureTask.java:166)
      	at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1146)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      	at java.lang.Thread.run(Thread.java:679)
      Sep 6, 2013 8:41:09 AM hudson.security.AuthenticationProcessingFilter2 onUnsuccessfulAuthentication
      INFO: Login attempt failed
      org.acegisecurity.BadCredentialsException: Bad credentials
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator.authenticate(BindAuthenticator.java:76)
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator2.authenticate(BindAuthenticator2.java:49)
      	at org.acegisecurity.providers.ldap.LdapAuthenticationProvider.retrieveUser(LdapAuthenticationProvider.java:233)
      	at org.acegisecurity.providers.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:122)
      	at org.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:200)
      	at org.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:47)
      	at org.acegisecurity.ui.webapp.AuthenticationProcessingFilter.attemptAuthentication(AuthenticationProcessingFilter.java:74)
      	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:252)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:174)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:64)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
      	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
      	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:46)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
      	at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:227)
      	at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
      	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
      	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
      	at java.util.concurrent.FutureTask.run(FutureTask.java:166)
      	at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1146)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      	at java.lang.Thread.run(Thread.java:679)
      

          [JENKINS-19483] LDAP plugin sets userSearchDN incorrectly

          Sebastian F. added a comment - - edited

          Simlar problem with:
          Jenkins 2.34
          LDAP Plugin 1.13
          Apache Tomcat/8.5.8
          OpenJDK 1.8.0_111-b15
          RHEL 6.6

          Configured the following:
          <securityRealm class="hudson.security.LDAPSecurityRealm" plugin="ldap@1.13">
          <server>ldap://test.srv.mydomain:389</server>
          <rootDN>DC=testde,DC=rootdom,DC=net</rootDN>
          <inhibitInferRootDN>false</inhibitInferRootDN>
          <userSearchBase>OU=User</userSearchBase>
          <userSearch>cn={0}</userSearch>

          From Log I can see that initialization is correct:

          29-Nov-2016 07:34:30.680 INFO [Finalizing set up] org.acegisecurity.ldap.DefaultInitialDirContextFactory.setProviderUrl  URL 'ldap://test.srv.mydomain/DC=testde,DC=rootdom,DC=net', root DN is 'DC=testde,DC=rootdom,DC=net'
          29-Nov-2016 07:34:30.712 INFO [Finalizing set up] org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator.setGroupSearchBase groupSearchBase is empty. Searches will be performed from the root: DC=testde,DC=rootdom,DC=net
          
          

          29-Nov-2016 07:34:57.190 WARNING [Handling POST /jenkins/j_acegi_security_check from xxx.xxx.xxx.xxxx : https-jsse-nio-8443-exec-2] org.acegisecurity.providers.ldap.authenticator.BindAuthenticator2.handleBindException Failed to bind to LDAP: userDnldap://testde.rootdom.net:389/CN=testuser,OU=User,DC=testde,DC=rootdom,DC=net,OU=User,DC=testde,DC=rootdom,DC=net username=testuser
          javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A8, comment: AcceptSecurityContext error, data 52e, v1db1^@]

          What makes me wonder is:

          1. Why it does not use configured ldap server
          2. Why is userSearchBase + RootDN added a second time

          Sebastian F. added a comment - - edited Simlar problem with: Jenkins 2.34 LDAP Plugin 1.13 Apache Tomcat/8.5.8 OpenJDK 1.8.0_111-b15 RHEL 6.6 Configured the following: <securityRealm class="hudson.security.LDAPSecurityRealm" plugin="ldap@1.13"> <server> ldap://test.srv.mydomain:389 </server> <rootDN>DC=testde,DC=rootdom,DC=net</rootDN> <inhibitInferRootDN>false</inhibitInferRootDN> <userSearchBase>OU=User</userSearchBase> <userSearch>cn={0}</userSearch> From Log I can see that initialization is correct: 29-Nov-2016 07:34:30.680 INFO [Finalizing set up] org.acegisecurity.ldap.DefaultInitialDirContextFactory.setProviderUrl URL 'ldap: //test.srv.mydomain/DC=testde,DC=rootdom,DC=net' , root DN is 'DC=testde,DC=rootdom,DC=net' 29-Nov-2016 07:34:30.712 INFO [Finalizing set up] org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator.setGroupSearchBase groupSearchBase is empty. Searches will be performed from the root: DC=testde,DC=rootdom,DC=net 29-Nov-2016 07:34:57.190 WARNING [Handling POST /jenkins/j_acegi_security_check from xxx.xxx.xxx.xxxx : https-jsse-nio-8443-exec-2] org.acegisecurity.providers.ldap.authenticator.BindAuthenticator2.handleBindException Failed to bind to LDAP: userDn ldap://testde.rootdom.net:389 /CN=testuser,OU=User,DC=testde,DC=rootdom,DC=net, OU=User,DC=testde,DC=rootdom,DC=net username=testuser javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A8, comment: AcceptSecurityContext error, data 52e, v1db1^@] What makes me wonder is: Why it does not use configured ldap server Why is userSearchBase + RootDN added a second time

          Oleg Nenashev added a comment -

          In order to set proper expectation, I have unassigned Kohsuke from this tickets.
          Currently there is no Default assignee in the LDAP plugin, any contributions will be appreciated.

          Oleg Nenashev added a comment - In order to set proper expectation, I have unassigned Kohsuke from this tickets. Currently there is no Default assignee in the LDAP plugin, any contributions will be appreciated.

            Unassigned Unassigned
            lremes Lars Remes
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: