Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-20733

SASL authentication with Active Directory

XMLWordPrintable

      Instead of simple bind, use SASL to provide some degree of data encryption out of the box.

      MSDN lists various mechanisms that AD supports, and it includes DIGEST-MD5, which works with plain text password Jenkins has received from the browser (via the login form.) SASL is supported by JNDI LDAP implementation so activating it should be very simple.

          [JENKINS-20733] SASL authentication with Active Directory

          Kohsuke Kawaguchi created issue -
          Kohsuke Kawaguchi made changes -
          Description Original: Instead of simple bind, use [SASL|http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer] to provide some degree of data encryption out of the box.

          MSDN [lists various mechanisms|http://msdn.microsoft.com/en-us/library/cc223500.aspx] that AD supports, and it includes DIGEST-MD5, which works with plain text password Jenkins has received from the browser (via the login form.) SASL is [supported by JNDI LDAP implementation](http://docs.oracle.com/javase/tutorial/jndi/ldap/sasl.html) so activating it should be very simple.
          		 New: Instead of simple bind, use [SASL|http://en.wikipedia.org/wiki/Simple_Authentication_and_Security_Layer] to provide some degree of data encryption out of the box.

          MSDN [lists various mechanisms|http://msdn.microsoft.com/en-us/library/cc223500.aspx] that AD supports, and it includes DIGEST-MD5, which works with plain text password Jenkins has received from the browser (via the login form.) SASL is [supported by JNDI LDAP implementation|http://docs.oracle.com/javase/tutorial/jndi/ldap/sasl.html] so activating it should be very simple.

          Kohsuke Kawaguchi added a comment -

          One of the reasons people want JENKINS-3730 is to avoid plain text password on the network caused by simple bind. This will prevent that.

          Kohsuke Kawaguchi added a comment - One of the reasons people want JENKINS-3730 is to avoid plain text password on the network caused by simple bind. This will prevent that.
          Kohsuke Kawaguchi made changes -
          Link New: This issue is related to JENKINS-3730 [ JENKINS-3730 ]

          Kohsuke Kawaguchi added a comment -

          JENKINS-15847 indicates that maybe this is also useful for LDAP plugin.

          Kohsuke Kawaguchi added a comment - JENKINS-15847 indicates that maybe this is also useful for LDAP plugin.
          Kohsuke Kawaguchi made changes -
          Link New: This issue is related to JENKINS-15847 [ JENKINS-15847 ]
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 152542 ] New: JNJira + In-Review [ 178245 ]

            Unassigned Unassigned
            kohsuke Kohsuke Kawaguchi
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: