[JENKINS-67491] Build failure due to disabled LDAP user

Type: Bug
Resolution: Fixed
Priority: Critical
Component/s: git-plugin
Labels:
None
Environment:
Jenkins: 2.319.1
git plugin: 4.10.1

Similar Issues:
Powered by SuggestiMate

Show
Released As:
4.10.2

Hi, this issue is similar to JENKINS-64629 but I see the failure in git plugin:

FATAL: org.springframework.security.authentication.DisabledException: The user "replaced" is administratively disabled.
org.springframework.security.authentication.DisabledException: The user "replaced" is administratively disabled.
	at hudson.security.UserAttributesHelper.checkIfUserEnabled(UserAttributesHelper.java:92)
	at hudson.security.LDAPSecurityRealm$LDAPUserDetailsService.loadUserByUsername(LDAPSecurityRealm.java:1315)
	at hudson.security.LDAPSecurityRealm$DelegateLDAPUserDetailsService.loadUserByUsername(LDAPSecurityRealm.java:1228)
	at hudson.security.LDAPSecurityRealm.loadUserByUsername2(LDAPSecurityRealm.java:763)
	at jenkins.security.UserDetailsCache$Retriever.call(UserDetailsCache.java:165)
	at jenkins.security.UserDetailsCache$Retriever.call(UserDetailsCache.java:154)
	at com.google.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4767)
	at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3568)
	at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2350)
	at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2313)
	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2228)
Caused: com.google.common.util.concurrent.UncheckedExecutionException
	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2234)
	at com.google.common.cache.LocalCache.get(LocalCache.java:3965)
	at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4764)
	at jenkins.security.UserDetailsCache.loadUserByUsername(UserDetailsCache.java:122)
	at hudson.model.User$UserIDCanonicalIdResolver.resolveCanonicalId(User.java:1251)
	at hudson.model.User$CanonicalIdResolver.resolve(User.java:1192)
	at hudson.model.User.get(User.java:523)
	at hudson.plugins.git.GitChangeSet.findOrCreateUser(GitChangeSet.java:460)
	at hudson.plugins.git.GitChangeSet.getAuthor(GitChangeSet.java:541)
	at jenkins.scm.RunWithSCM.calculateCulprits(RunWithSCM.java:139)
	at hudson.model.AbstractBuild.calculateCulprits(AbstractBuild.java:342)
	at jenkins.scm.RunWithSCM.getCulprits(RunWithSCM.java:94)
	at hudson.model.AbstractBuild.getCulprits(AbstractBuild.java:331)
	at jenkins.scm.RunWithSCM.calculateCulprits(RunWithSCM.java:134)
	at hudson.model.AbstractBuild.calculateCulprits(AbstractBuild.java:342)
	at jenkins.scm.RunWithSCM.getCulprits(RunWithSCM.java:94)
	at hudson.model.AbstractBuild.getCulprits(AbstractBuild.java:331)
	at jenkins.scm.RunWithSCM.calculateCulprits(RunWithSCM.java:134)
	at hudson.model.AbstractBuild.calculateCulprits(AbstractBuild.java:342)
	at jenkins.scm.RunWithSCM.getCulprits(RunWithSCM.java:94)
	at hudson.model.AbstractBuild.getCulprits(AbstractBuild.java:331)
	at jenkins.scm.RunWithSCM.calculateCulprits(RunWithSCM.java:134)
	at hudson.model.AbstractBuild.calculateCulprits(AbstractBuild.java:342)
	at jenkins.scm.RunWithSCM.getCulprits(RunWithSCM.java:94)
	at hudson.model.AbstractBuild.getCulprits(AbstractBuild.java:331)
	at jenkins.scm.RunWithSCM.calculateCulprits(RunWithSCM.java:134)
	at hudson.model.AbstractBuild.calculateCulprits(AbstractBuild.java:342)
	at jenkins.scm.RunWithSCM.getCulprits(RunWithSCM.java:94)
	at hudson.model.AbstractBuild.getCulprits(AbstractBuild.java:331)
	at jenkins.scm.RunWithSCM.calculateCulprits(RunWithSCM.java:134)
	at hudson.model.AbstractBuild.calculateCulprits(AbstractBuild.java:342)
	at jenkins.scm.RunWithSCM.getCulprits(RunWithSCM.java:94)
	at hudson.model.AbstractBuild.getCulprits(AbstractBuild.java:331)
	at jenkins.scm.RunWithSCM.calculateCulprits(RunWithSCM.java:134)
	at hudson.model.AbstractBuild.calculateCulprits(AbstractBuild.java:342)
	at jenkins.scm.RunWithSCM.getCulprits(RunWithSCM.java:94)
	at hudson.model.AbstractBuild.getCulprits(AbstractBuild.java:331)
	at jenkins.scm.RunWithSCM.calculateCulprits(RunWithSCM.java:134)
	at hudson.model.AbstractBuild.calculateCulprits(AbstractBuild.java:342)
	at jenkins.scm.RunWithSCM.getCulprits(RunWithSCM.java:94)
	at hudson.model.AbstractBuild.getCulprits(AbstractBuild.java:331)
	at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:703)
	at hudson.model.Run.execute(Run.java:1913)
	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
	at hudson.model.ResourceController.execute(ResourceController.java:99)
	at hudson.model.Executor.run(Executor.java:432)
Finished: FAILURE

The actual username was replaced.

relates to

JENKINS-67981 Build failure due to ldap disabled account

Closed

links to

CI job that will build the git plugin prototype for testing

PR-1202 ignore authentication exception when generating changeset

Mark Waite added a comment - 2022-01-03 12:31

basil the failure reported in the git plugin seems to be due to a call to User.get(). That code in the git plugin is already attempting to handle surprises and return User.getUnknown() when surprises happen. Should I add a try/catch for org.springframework.security.authentication.DisabledException into that section of GitChangeSet?

Mark Waite added a comment - 2022-01-03 12:31 basil the failure reported in the git plugin seems to be due to a call to User.get() . That code in the git plugin is already attempting to handle surprises and return User.getUnknown() when surprises happen. Should I add a try/catch for org.springframework.security.authentication.DisabledException into that section of GitChangeSet ?

Basil Crow added a comment - 2022-01-03 13:45

markewaite This looks like a duplicate of JENKINS-64629, the gift that keeps on giving. Similar changes had to be made in jenkinsci/email-ext-plugin#277 and jenkinsci/mailer-plugin#104, which I think can serve as a useful model for you with the Git plugin.

Basil Crow added a comment - 2022-01-03 13:45 markewaite This looks like a duplicate of JENKINS-64629 , the gift that keeps on giving. Similar changes had to be made in jenkinsci/email-ext-plugin#277 and jenkinsci/mailer-plugin#104 , which I think can serve as a useful model for you with the Git plugin.

Mark Waite added a comment - 2022-01-08 14:12

hv2022 could you download the build from https://ci.jenkins.io/job/Plugins/job/git-plugin/view/change-requests/job/PR-1202/ and use it in your environment? I'd like confirmation that catching the exception is sufficient and that you don't detect unexpected side effects.

If you have a test instance, I'd also appreciate if you could test with "Create account based on email" enabled in the global settings of the git plugin. You probably should not do that test on a production environment, since that setting may cause the creation of many accounts on your system.

Mark Waite added a comment - 2022-01-08 14:12 hv2022 could you download the build from https://ci.jenkins.io/job/Plugins/job/git-plugin/view/change-requests/job/PR-1202/ and use it in your environment? I'd like confirmation that catching the exception is sufficient and that you don't detect unexpected side effects. If you have a test instance, I'd also appreciate if you could test with "Create account based on email" enabled in the global settings of the git plugin. You probably should not do that test on a production environment, since that setting may cause the creation of many accounts on your system.

hleb v added a comment - 2022-01-10 16:30

markewaite I'll create a test instance and validate your test build asap.

hleb v added a comment - 2022-01-10 16:30 markewaite I'll create a test instance and validate your test build asap.

hleb v added a comment - 2022-01-13 11:26

It look the change fixed the issue

hleb v added a comment - 2022-01-13 11:26 It look the change fixed the issue

Mark Waite added a comment - 2022-01-13 13:28

It look the change fixed the issue

Thanks very much. Were you able to check to see if the issue remains resolved even if you change the setting of "Create account based on email" in the global settings of the git plugin?

Mark Waite added a comment - 2022-01-13 13:28 It look the change fixed the issue Thanks very much. Were you able to check to see if the issue remains resolved even if you change the setting of "Create account based on email" in the global settings of the git plugin?

hleb v added a comment - 2022-01-14 11:55 - edited

Unfortunately no. I haven't tested this as we don't use such feature.

hleb v added a comment - 2022-01-14 11:55 - edited Unfortunately no. I haven't tested this as we don't use such feature.

Mark Waite added a comment - 2022-01-15 11:24

Released as 4.10.2 on Jan 14, 2022

Mark Waite added a comment - 2022-01-15 11:24 Released as 4.10.2 on Jan 14, 2022

Assignee:: Mark Waite

Reporter:: hleb v

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Created:: 2022-01-03 11:58

Updated:: 2022-03-09 04:02

Resolved:: 2022-01-10 14:41

Details

Description

Attachments

Issue Links

Activity

Collapse comment: Mark Waite added a comment - 2022-01-03 12:31

Expand comment: Mark Waite added a comment - 2022-01-03 12:31

Collapse comment: Basil Crow added a comment - 2022-01-03 13:45

Expand comment: Basil Crow added a comment - 2022-01-03 13:45

Collapse comment: Mark Waite added a comment - 2022-01-08 14:12

Expand comment: Mark Waite added a comment - 2022-01-08 14:12

Collapse comment: hleb v added a comment - 2022-01-10 16:30

Expand comment: hleb v added a comment - 2022-01-10 16:30

Collapse comment: hleb v added a comment - 2022-01-13 11:26

Expand comment: hleb v added a comment - 2022-01-13 11:26

Collapse comment: Mark Waite added a comment - 2022-01-13 13:28

Expand comment: Mark Waite added a comment - 2022-01-13 13:28

Collapse comment: hleb v added a comment - 2022-01-14 11:55, Edited by hleb v - 2022-01-14 12:00

Expand comment: hleb v added a comment - 2022-01-14 11:55, Edited by hleb v - 2022-01-14 12:00

Collapse comment: Mark Waite added a comment - 2022-01-15 11:24

Expand comment: Mark Waite added a comment - 2022-01-15 11:24

People

Dates