Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-19483

LDAP plugin sets userSearchDN incorrectly

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Major Major
    • ldap-plugin
    • None
    • linux, jenkins 1.589, LDAP plugin 1.6, OpenJDK Runtime Environment (IcedTea6 1.12.6) (6b27-1.12.6-1ubuntu0.12.04.2), OpenJDK 64-Bit Server VM (build 20.0-b12, mixed mode)

      When settings user search base (see attachment), the LDAP plugin incorrect creates the DN for user lookup. For some reason, ou=People,dc=symbio,dc=com is still appended to the DN when it should replaced by the user search base and root DN.

      This can be clearly seen from the log message:

      Sep 6, 2013 8:41:09 AM org.acegisecurity.providers.ldap.authenticator.BindAuthenticator2 handleBindException
      WARNING: Failed to bind to LDAP: userDnldaps://xxxxxxxxxxxxx:636/uid=test.user,ou=People,dc=symbio,dc=com,ou=AU,ou=Views,dc=symbio,dc=com  username=lars.remes
      javax.naming.AuthenticationException: [LDAP: error code 32 - No Such Object]
      	at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:290)
      	at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2685)
      	at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:306)
      	at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)
      	at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
      	at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
      	at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
      	at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)
      	at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
      	at javax.naming.InitialContext.init(InitialContext.java:240)
      	at javax.naming.InitialContext.<init>(InitialContext.java:214)
      	at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:99)
      	at org.acegisecurity.ldap.DefaultInitialDirContextFactory.connect(DefaultInitialDirContextFactory.java:180)
      	at org.acegisecurity.ldap.DefaultInitialDirContextFactory.newInitialDirContext(DefaultInitialDirContextFactory.java:261)
      	at org.acegisecurity.ldap.LdapTemplate.execute(LdapTemplate.java:123)
      	at org.acegisecurity.ldap.LdapTemplate.retrieveEntry(LdapTemplate.java:165)
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator.bindWithDn(BindAuthenticator.java:87)
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator.authenticate(BindAuthenticator.java:72)
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator2.authenticate(BindAuthenticator2.java:49)
      	at org.acegisecurity.providers.ldap.LdapAuthenticationProvider.retrieveUser(LdapAuthenticationProvider.java:233)
      	at org.acegisecurity.providers.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:122)
      	at org.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:200)
      	at org.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:47)
      	at org.acegisecurity.ui.webapp.AuthenticationProcessingFilter.attemptAuthentication(AuthenticationProcessingFilter.java:74)
      	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:252)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:174)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:64)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
      	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
      	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:46)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
      	at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:227)
      	at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
      	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
      	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
      	at java.util.concurrent.FutureTask.run(FutureTask.java:166)
      	at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1146)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      	at java.lang.Thread.run(Thread.java:679)
      Sep 6, 2013 8:41:09 AM hudson.security.AuthenticationProcessingFilter2 onUnsuccessfulAuthentication
      INFO: Login attempt failed
      org.acegisecurity.BadCredentialsException: Bad credentials
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator.authenticate(BindAuthenticator.java:76)
      	at org.acegisecurity.providers.ldap.authenticator.BindAuthenticator2.authenticate(BindAuthenticator2.java:49)
      	at org.acegisecurity.providers.ldap.LdapAuthenticationProvider.retrieveUser(LdapAuthenticationProvider.java:233)
      	at org.acegisecurity.providers.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:122)
      	at org.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:200)
      	at org.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:47)
      	at org.acegisecurity.ui.webapp.AuthenticationProcessingFilter.attemptAuthentication(AuthenticationProcessingFilter.java:74)
      	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:252)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:174)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:64)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
      	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
      	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:46)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
      	at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      	at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      	at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
      	at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:227)
      	at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
      	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
      	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
      	at java.util.concurrent.FutureTask.run(FutureTask.java:166)
      	at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
      	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1146)
      	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
      	at java.lang.Thread.run(Thread.java:679)
      

            Unassigned Unassigned
            lremes Lars Remes
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: