jenkinsci / jenkinsci/active-directory-plugin

[JENKINS-11990] After updating Active Directory plugin the Jenkins People database is experiencing massive performance issues synching because it is trying to authenticate users that are no longer in company Active Directory but are part of the Jenkins Database

Open
#352 9 comments 0 reactions 0 assignees View on GitHub
component:active-directory-plugin imported-jira-issue priority:critical resolution:unresolved security
Dominant language
Java
Stars
53
Forks
115
No merged PRs in 30d

Description

After the issues with the 1.23 identified here https://issues.jenkins-ci.org/browse/JENKINS-11720 and upgrading to 1.23 I am experiencing serious performance problems because the Jenkins internal database contains users that are no longer part of the company active directory and the system is trying to validate all the users. It now takes the "People" page over 10 mins to load every time it is clicked. Attempts to go there produce the following error:

Dec 5, 2011 2:09:37 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Exhausted all configured domains and could not authenticate against any.

Dec 5, 2011 2:09:37 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Credential exception tying to authenticate against xxxxxxxxxxx domain

hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)

at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)

at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)

at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)

at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)

at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)

at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)

at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)

at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)

at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)

at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:692)

at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:667)

at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:645)

at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)

at hudson.model.Run.run(Run.java:1448)

at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)

at hudson.model.ResourceController.execute(ResourceController.java:88)

at hudson.model.Executor.run(Executor.java:230)

I have removed the company's domain name and replaced it with the xxxxxxxx entry in the error message for obvious reasons. Not sure if these users that no longer are part of the active directory can just be deleted without causing other issues/problems. Jenkis display information is maintained in this People database so it is needed. Not sure if deleting members no longer in AD will cause Jenkins to have display issues or other problems.

It was nice to be able to use the Jenkins internal People Database to configure the display of users which when using active directory only show as numerical IDs. It seems that this capability is now lost because of the new AD plug-in.

NEW SIDE EFFECT:

I am seeing an additional issue I believe is related to this problem. A job will build successfully but never complete as the system continues to try and validate the person that checked in the code and fails:

WARNING: RegExMailAddressResolver configuration for regex null and email pattern null is not valid.

Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Credential exception tying to authenticate against xxxxxxx domain

hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)

at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)

at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)

at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)

at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)

at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)

at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)

at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)

at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)

at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)

at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:697)

at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:672)

at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:650)

at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)

at hudson.model.Run.run(Run.java:1448)

at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)

at hudson.model.ResourceController.execute(ResourceController.java:88)

at hudson.model.Executor.run(Executor.java:238)

Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Credential exception tying to authenticate against xxxxxxxxx domain

hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)

at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)

at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)

at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)

at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)

at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)

at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)

at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)

at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)

at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)

at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)

at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:697)

at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:672)

at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:650)

at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)

at hudson.model.Run.run(Run.java:1448)

at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)

at hudson.model.ResourceController.execute(ResourceController.java:88)

at hudson.model.Executor.run(Executor.java:238)

Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

I have to restart Jenkins to clear out the locked job because it blocks any other jobs from running.

---
Originally reported by alexlombardi, imported from: After updating Active Directory plugin the Jenkins People database is experiencing massive performance issues synching because it is trying to authenticate users that are no longer in company Active Directory but are part of the Jenkins Database


  • status: Open
  • priority: Critical
  • component(s): active-directory-plugin
  • label(s): jenkins, plugin, security
  • resolution: Unresolved
  • votes: 1
  • watchers: 3
  • imported: 2025-12-07

Raw content of original issue

After the issues with the 1.23 identified here https://issues.jenkins-ci.org/browse/JENKINS-11720 and upgrading to 1.23 I am experiencing serious performance problems because the Jenkins internal database contains users that are no longer part of the company active directory and the system is trying to validate all the users. It now takes the "People" page over 10 mins to load every time it is clicked. Attempts to go there produce the following error:



Dec 5, 2011 2:09:37 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Exhausted all configured domains and could not authenticate against any.

Dec 5, 2011 2:09:37 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Credential exception tying to authenticate against xxxxxxxxxxx domain

hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)

	at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)

	at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)

	at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)

	at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)

	at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)

	at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)

	at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)

	at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)

	at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)

	at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:692)

	at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:667)

	at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:645)

	at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)

	at hudson.model.Run.run(Run.java:1448)

	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)

	at hudson.model.ResourceController.execute(ResourceController.java:88)

	at hudson.model.Executor.run(Executor.java:230)



I have removed the company's domain name and replaced it with the xxxxxxxx entry in the error message for obvious reasons. Not sure if these users that no longer are part of the active directory can just be deleted without causing other issues/problems. Jenkis display information is maintained in this People database so it is needed. Not sure if deleting members no longer in AD will cause Jenkins to have display issues or other problems.



It was nice to be able to use the Jenkins internal People Database to configure the display of users which when using active directory only show as numerical IDs. It seems that this capability is now lost because of the new AD plug-in.



NEW SIDE EFFECT:



I am seeing an additional issue I believe is related to this problem. A job will build successfully but never complete as the system continues to try and validate the person that checked in the code and fails:



WARNING: RegExMailAddressResolver configuration for regex null and email pattern null is not valid.

Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Credential exception tying to authenticate against xxxxxxx domain

hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)

	at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)

	at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)

	at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)

	at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)

	at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)

	at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)

	at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)

	at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)

	at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)

	at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:697)

	at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:672)

	at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:650)

	at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)

	at hudson.model.Run.run(Run.java:1448)

	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)

	at hudson.model.ResourceController.execute(ResourceController.java:88)

	at hudson.model.Executor.run(Executor.java:238)

Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Credential exception tying to authenticate against xxxxxxxxx domain

hudson.security.UserMayOrMayNotExistException: Unable to retrieve the user information without bind DN/password configured

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:129)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:105)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:64)

	at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:23)

	at hudson.plugins.active_directory.ActiveDirectoryMailAddressResolverImpl.findMailAddressFor(ActiveDirectoryMailAddressResolverImpl.java:31)

	at hudson.tasks.MailAddressResolver.resolve(MailAddressResolver.java:100)

	at hudson.tasks.Mailer$UserProperty.getAddress(Mailer.java:488)

	at hudson.plugins.emailext.ExtendedEmailPublisher.createMail(ExtendedEmailPublisher.java:315)

	at hudson.plugins.emailext.ExtendedEmailPublisher.sendMail(ExtendedEmailPublisher.java:235)

	at hudson.plugins.emailext.ExtendedEmailPublisher._perform(ExtendedEmailPublisher.java:227)

	at hudson.plugins.emailext.ExtendedEmailPublisher.perform(ExtendedEmailPublisher.java:189)

	at hudson.tasks.BuildStepMonitor$3.perform(BuildStepMonitor.java:36)

	at hudson.model.AbstractBuild$AbstractRunner.perform(AbstractBuild.java:697)

	at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:672)

	at hudson.model.AbstractBuild$AbstractRunner.performAllBuildSteps(AbstractBuild.java:650)

	at hudson.model.Build$RunnerImpl.cleanUp(Build.java:171)

	at hudson.model.Run.run(Run.java:1448)

	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)

	at hudson.model.ResourceController.execute(ResourceController.java:88)

	at hudson.model.Executor.run(Executor.java:238)

Jan 5, 2012 2:32:40 AM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser



I have to restart Jenkins to clear out the locked job because it blocks any other jobs from running.

  • environment: Running Master-Slave configuration on Windows 2003 server

5 attachments

- [Thread Dump1.doc](https://issues.jenkins.io/secure/attachment/21331/Thread%20Dump1.doc)
- [Thread Dump2.doc](https://issues.jenkins.io/secure/attachment/21330/Thread%20Dump2.doc)
- [Thread Dump3.doc](https://issues.jenkins.io/secure/attachment/21329/Thread%20Dump3.doc)
- [Thread Dump4.doc](https://issues.jenkins.io/secure/attachment/21328/Thread%20Dump4.doc)
- [Thread Dump5.doc](https://issues.jenkins.io/secure/attachment/21327/Thread%20Dump5.doc)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.