LDAP in Jenkins Fails, but ldapsearch works

[Sverre Moe]

I have configured authentication with LDAP

My LDAP Configuration:
Server: helios.company.com
root DN: dc=arctic,dc=company,dc=com
User search base: ou=users
User search filter: samaccountname={0}
Group membership: Parse user attribute for list of groups => memberOf
Manager DN: ***@arctic.company.com
Manager password: ldapUserPassword
Display Name LDAP Attribute: displayName
Email Address LDAP Attribute: mail

There is an port opening between my Jenkins server and helios.company.com
since ldapsearch is working fine
ldapsearch -D ***@arctic.company.com -w ldapUserPassword -h helios.
company.com -b "dc=arctic,dc=company,dc=com" "samaccountname=user"


What is missing from the configuration?

If I use the same configuration on another Jenkins running within the same
subnet of my ldap server, it works. I then cannot falter the configuration,
however why does ldapsearch work?

I cannot see anything wrong in the Jenkins log (it is empty). I have added
logger for org.acegisecurity, hudson.security and jenkins.security with log
level INFO.

[Maciej Jaros]

|Usersearch base:ou=users
|

I think it should be "CN=Users".

|
Usersearch filter:samaccountname={0}
|

Not sure if case matters, but we use "sAMAccountName={0}"

|

This is Windows AD? If so then I think you should use "domain\user"
format. At least it works for me.

Regards,
Nux.

[Sverre Moe]

I have done nothing with the LDAP configuration, but now it works. It takes
30 seconds before I'm logged in.
The only thing I have done is to add Proxy configuration to Jenkins.

I have tried both samaccountname and sAMAccountName. I don't think ours is
case sensitive.

Using DOMAIN\username does not work.

Post by Sverre Moe
User search base: ou=users
I think it should be "CN=Users".
User search filter: samaccountname={0}
Not sure if case matters, but we use "sAMAccountName={0}"
This is Windows AD? If so then I think you should use "domain\user"
format. At least it works for me.
Regards,
Nux.

[Sverre Moe]

I spoke to soon. It worked for a short while, but now I am getting several
invalid login "Invalid login information. Please try again. "
There is still nothing in the log.

What is Jenkins doing different than ldapsearch. It should communicate with
the server on default port 389. I am using a Proxy, but both Jenkins and
Java has been configured to use this proxy.

Post by Sverre Moe
I have done nothing with the LDAP configuration, but now it works. It
takes 30 seconds before I'm logged in.
The only thing I have done is to add Proxy configuration to Jenkins.
I have tried both samaccountname and sAMAccountName. I don't think ours
is case sensitive.
Using DOMAIN\username does not work.

Post by Sverre Moe
User search base: ou=users
I think it should be "CN=Users".
User search filter: samaccountname={0}
Not sure if case matters, but we use "sAMAccountName={0}"
This is Windows AD? If so then I think you should use "domain\user"
format. At least it works for me.
Regards,
Nux.

[James Nord]

if you are using port 389 then unless TLS upgrade is happening then this is
all plaintext (including your passwords!) so I would suggest a network
capture with wireshark and then compare Jenkins and ldapsearch and see if
you can spot some differences that can lead you to understand why this is
happening.

Post by Sverre Moe
I spoke to soon. It worked for a short while, but now I am getting several
invalid login "Invalid login information. Please try again. "
There is still nothing in the log.
What is Jenkins doing different than ldapsearch. It should communicate
with the server on default port 389. I am using a Proxy, but both Jenkins
and Java has been configured to use this proxy.

Post by Sverre Moe
I have done nothing with the LDAP configuration, but now it works. It
takes 30 seconds before I'm logged in.
The only thing I have done is to add Proxy configuration to Jenkins.
I have tried both samaccountname and sAMAccountName. I don't think ours
is case sensitive.
Using DOMAIN\username does not work.

Post by Sverre Moe
User search base: ou=users
I think it should be "CN=Users".
User search filter: samaccountname={0}
Not sure if case matters, but we use "sAMAccountName={0}"
This is Windows AD? If so then I think you should use "domain\user"
format. At least it works for me.
Regards,
Nux.

[Adis Azizan]

Same issues with me. Anybody actually can solve this? I try to use ldaps://
and it given me different error which is SSL Exception

Post by Sverre Moe
I have configured authentication with LDAP
Server: helios.company.com
root DN: dc=arctic,dc=company,dc=com
User search base: ou=users
User search filter: samaccountname={0}
Group membership: Parse user attribute for list of groups => memberOf
Manager password: ldapUserPassword
Display Name LDAP Attribute: displayName
Email Address LDAP Attribute: mail
There is an port opening between my Jenkins server and helios.company.com
since ldapsearch is working fine
company.com -b "dc=arctic,dc=company,dc=com" "samaccountname=user"
What is missing from the configuration?
If I use the same configuration on another Jenkins running within the same
subnet of my ldap server, it works. I then cannot falter the configuration,
however why does ldapsearch work?
I cannot see anything wrong in the Jenkins log (it is empty). I have added
logger for org.acegisecurity, hudson.security and jenkins.security with log
level INFO.

[Shravan naidu]

The Jenkins LDAP plugin has a bug which fills up manager DN field with a
random string and that fails the login procedure. Luckily, the manager DN
field is not mandatoy to be filled and can be left blank. I would recommend
to fill root DN and leave rest of the field blank and try logging in. I had
the same prob.

Post by Sverre Moe
I have configured authentication with LDAP
Server: helios.company.com
root DN: dc=arctic,dc=company,dc=com
User search base: ou=users
User search filter: samaccountname={0}
Group membership: Parse user attribute for list of groups => memberOf
Manager password: ldapUserPassword
Display Name LDAP Attribute: displayName
Email Address LDAP Attribute: mail
There is an port opening between my Jenkins server and helios.company.com
since ldapsearch is working fine
company.com -b "dc=arctic,dc=company,dc=com" "samaccountname=user"
What is missing from the configuration?
If I use the same configuration on another Jenkins running within the same
subnet of my ldap server, it works. I then cannot falter the configuration,
however why does ldapsearch work?
I cannot see anything wrong in the Jenkins log (it is empty). I have added
logger for org.acegisecurity, hudson.security and jenkins.security with log
level INFO.