Same problem with my installation. I used project base matrix authorization. The
global permissions work until READ was revoked from anonymous. The other
permissions, especially ADMINISTER, seem to work, but it did no in-depth
analysis. Project permissions didn't apply either.

I can reproduce it on Version 1.244 and 1.249.

I've been able to successfully get link Matrix-based security validated against
LDAP Security Roles. Took a little while to work out but as long as you
populate the groupSearchBase DN record it seems to hang together.

Key link I was Missing was the naming convention... Not quite shown in the help...

If you have a LDAP role called "CN=Blackberry Users,OU=Security
Groups,OU=Bidalonier,DC=acme,DC=int" then the role you add in the matrix window
has to be "ROLE_BLACKBERRY USERS"

e.g.

<securityRealm class="hudson.security.LDAPSecurityRealm">
<server>192.168.0.10</server>
<rootDN>DC=acme,DC=int</rootDN>
<userSearchBase>OU=Bidalonier</userSearchBase>
<userSearch>sAMAccountName=

</userSearch>
<groupSearchBase>OU=Security\20Groups,OU=Bidalonier</groupSearchBase>
<managerDN>ACME\clarkeja</managerDN>
<managerPassword>dfghdghgfsdfsdfgdfg</managerPassword>
</securityRealm>

Even better, if there are no groups/roles assigned hudson tells you what ROLES_
the ldap user account has in the exception stack, so it's a simple matter of
using the ones that are appropriate (well done once again to the Hudson crew!!!).

Hope this helps... So not sure that it is a bug as it seems to be working..
Maybe just the LDAP Help needs a bit of lipstick.

Using Hudson v1.255 against a Microsoft Active Directory

I have tested the same settings with version 1.257 and 1.249: 1.257 works
perferctly with ldap and project matrix authorization but 1.249 doesn't (again
same error as reported by clemp6r).

1.289 will include the last in a series of refactors in this area, so it will be
hard to trace any previously reported problems. So I'm going to close this
issue, but please do test when 1.289 (or newer) comes out and file new issues
for any LDAP problems you find (including improving the docs around ROLE_
prefix), thanks!