DependencyTrack / DependencyTrack/dependency-track
Problem Microsoft Active Directory LDAPs is not working
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
# Bug: LDAP not working with Microsoft AD in DT 5.0.1/5.0.2
## Environment
- **DT Version:** 5.0.1 and 5.0.2 (both tested)
- **Distribution:** Container Image (docker-compose)
- **LDAP:** Microsoft Active Directory, `ldap://:3268`, security auth `simple`
- **Database:** PostgreSQL 18
## Problem
LDAP authentication **never attempts to connect** to the LDAP server. All login requests return "Unauthorized login attempt / invalid credentials" without any LDAP-related log output, even at TRACE level.
## What we tried (all failed)
1. **`DT_LDAP_*` environment variables** – Server refused to start: `Legacy Dependency-Track v5.0.0-rc.1 configuration properties are no longer supported`
2. **`entrypoint` with `-D` arguments (dot notation)** – Same legacy error
3. **`entrypoint` with `-D` arguments (hyphen notation)** – Server starts, but only 4 of 14 properties loaded (`bind.password`, `bind.username`, `security.auth`, `server.url`). **`dt.ldap.enabled=true` not loaded.** No LDAP activity.
4. **`env_file` with `dt.ldap.*` properties** – All properties confirmed present in container (`env | grep dt.ldap`). **No LDAP connection attempt.**
5. **Mounting `application.properties`** – No effect
6. **`JAVA_TOOL_OPTIONS`** – Picked up by JVM. **Still no LDAP activity.**
7. **Quoted dot-properties in docker-compose** – Not set in container
8. **All logging levels (DEBUG/TRACE)** – No LDAP log output at any level
9. **Multiple username formats** (`user`, `user@domain`) – Same result
10. **Upgrade 5.0.1 → 5.0.2** – No change
## Key finding
All properties correctly set and confirmed in container, but **DT never triggers the LDAP authentication code path**.
## Workaround
**DT 4.14.2 with `ALPINE_LDAP_*` variables works perfectly** with the same LDAP server and credentials.
## Related Issues
- #5727 – Invalid Distinguished Name with Microsoft AD (open)
- #6316 – NPE with empty bind credentials (fixed)
- #5266 – User search filter ignored during auth (open)
### Steps to Reproduce
Just configurate LDAPs with Microsoft AD.
### Expected Behavior
When I configurate LDAPs it should work.
### Dependency-Track Version
5.x
### Browser
Mozilla Firefox
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Start by reproducing the LDAP login failure with Dependency-Track 5.0.1 or 5.0.2 in docker-compose, using the documented dt.ldap.* settings and TRACE logging. Compare the behavior with the reported working 4.14.2 setup and verify that LDAP authentication is attempted and produces LDAP-related logs before considering the issue resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker-compose, java, postgresql
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100