DependencyTrack / DependencyTrack/dependency-track

Problem Microsoft Active Directory LDAPs is not working

Open
#6,460 14 comments 0 reactions 0 assignees View on GitHub
defect pending more information
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

# Bug: LDAP not working with Microsoft AD in DT 5.0.1/5.0.2

## Environment
- **DT Version:** 5.0.1 and 5.0.2 (both tested)
- **Distribution:** Container Image (docker-compose)
- **LDAP:** Microsoft Active Directory, `ldap://:3268`, security auth `simple`
- **Database:** PostgreSQL 18

## Problem
LDAP authentication **never attempts to connect** to the LDAP server. All login requests return "Unauthorized login attempt / invalid credentials" without any LDAP-related log output, even at TRACE level.

## What we tried (all failed)
1. **`DT_LDAP_*` environment variables** – Server refused to start: `Legacy Dependency-Track v5.0.0-rc.1 configuration properties are no longer supported`
2. **`entrypoint` with `-D` arguments (dot notation)** – Same legacy error
3. **`entrypoint` with `-D` arguments (hyphen notation)** – Server starts, but only 4 of 14 properties loaded (`bind.password`, `bind.username`, `security.auth`, `server.url`). **`dt.ldap.enabled=true` not loaded.** No LDAP activity.
4. **`env_file` with `dt.ldap.*` properties** – All properties confirmed present in container (`env | grep dt.ldap`). **No LDAP connection attempt.**
5. **Mounting `application.properties`** – No effect
6. **`JAVA_TOOL_OPTIONS`** – Picked up by JVM. **Still no LDAP activity.**
7. **Quoted dot-properties in docker-compose** – Not set in container
8. **All logging levels (DEBUG/TRACE)** – No LDAP log output at any level
9. **Multiple username formats** (`user`, `user@domain`) – Same result
10. **Upgrade 5.0.1 → 5.0.2** – No change

## Key finding
All properties correctly set and confirmed in container, but **DT never triggers the LDAP authentication code path**.

## Workaround
**DT 4.14.2 with `ALPINE_LDAP_*` variables works perfectly** with the same LDAP server and credentials.

## Related Issues
- #5727 – Invalid Distinguished Name with Microsoft AD (open)
- #6316 – NPE with empty bind credentials (fixed)
- #5266 – User search filter ignored during auth (open)

### Steps to Reproduce

Just configurate LDAPs with Microsoft AD.

### Expected Behavior

When I configurate LDAPs it should work.

### Dependency-Track Version

5.x

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/main/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the LDAP login failure with Dependency-Track 5.0.1 or 5.0.2 in docker-compose, using the documented dt.ldap.* settings and TRACE logging. Compare the behavior with the reported working 4.14.2 setup and verify that LDAP authentication is attempted and produces LDAP-related logs before considering the issue resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker-compose, java, postgresql
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.