jenkinsci / jenkinsci/active-directory-plugin
[JENKINS-15073] Active directory authentication failed when no ssl is used
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 53
- Forks
- 115
- PR merge metrics
- No merged PRs in 30d
Description
I'm trying to use Active directory plugin to authenticate in Jenkins, but it's not working with the following log message:
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: SoftDev_GLOBAL is a member of CN=SoftDev_GLOBAL,CN=Users,DC=novacard,DC=local
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: InternetProxy is a member of CN=InternetProxy,CN=Users,DC=novacard,DC=local
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINER: Looking up group of
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: Stage 2: looking up via memberOf
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: Users
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: Remote Desktop Users
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: CERTSVC_DCOM_ACCESS
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: Projects_ISO 9001_R
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: SoftDev Local
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: SoftDev_GLOBAL
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: Domain Users
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: InternetProxy
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINER: Looking up group of CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: Found user v_okunev :
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
FINE: Failed to find v_okunev in userPrincipalName. Trying sAMAccountName
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm
FINE: Bound to ncfs.novacard.local:3268
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm
FINE: Binding as v_okunev@novacard.local to ldap://ncfs.novacard.local:3268/
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm
FINE: Failed to start TLS. Authentication will be done via plain-text LDAP
javax.naming.CommunicationException: Remote host closed connection during handshake [Root exception is javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake]
at com.sun.jndi.ldap.LdapCtx.extendedOperation(Unknown Source)
at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DesciprotrImpl.bind(ActiveDirectorySecurityRealm.java:413)
at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DesciprotrImpl.bind(ActiveDirectorySecurityRealm.java:357)
at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:245)
at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:190)
at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:134)
at org.acegisecurity.providers.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:119)
at org.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:195)
at org.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:45)
at org.acegisecurity.ui.webapp.AuthenticationProcessingFilter.attemptAuthentication(AuthenticationProcessingFilter.java:71)
at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:252)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:173)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:63)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:50)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:215)
at winstone.RequestHandlerThread.run(RequestHandlerThread.java:138)
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source)
at java.util.concurrent.FutureTask.run(Unknown Source)
at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.AppOutputStream.write(Unknown Source)
at java.io.BufferedOutputStream.flushBuffer(Unknown Source)
at java.io.BufferedOutputStream.flush(Unknown Source)
at com.sun.jndi.ldap.Connection.writeRequest(Unknown Source)
at com.sun.jndi.ldap.LdapClient.extendedOp(Unknown Source)
... 39 more
Caused by: java.io.EOFException: SSL peer shut down incorrectly
at com.sun.net.ssl.internal.ssl.InputRecord.read(Unknown Source)
... 47 more
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm
FINE: Connecting to ldap://ncfs.novacard.local:3268/
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm
FINE: _gc._tcp.novacard.local resolved to [ncfs.novacard.local:3268]
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm
FINE: SRV record found: 0 100 3268 ncfs.novacard.local.
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm
FINE: Attempting to resolve _gc._tcp.novacard.local to SRV record
Server with LDAP do not use SSL. What should I do in that way?
Originally reported by piratenn, imported from: Active directory authentication failed when no ssl is used
- status: Open
- priority: Major
- component(s): active-directory-plugin
- label(s): exception, plugin
- resolution: Unresolved
- votes: 0
- watchers: 1
- imported: 2025-12-07
Raw content of original issue
I'm trying to use Active directory plugin to authenticate in Jenkins, but it's not working with the following log message:
Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: SoftDev_GLOBAL is a member of CN=SoftDev_GLOBAL,CN=Users,DC=novacard,DC=local Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: InternetProxy is a member of CN=InternetProxy,CN=Users,DC=novacard,DC=local Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINER: Looking up group of
{tokengroups=tokenGroups: [B@1066d88, [B@1011f1f, [B@a24141, [B@6a16d4, [B@100e398, [B@15e10ab, [B@987c7d, [B@115272a, memberof=memberOf: CN=InternetProxy,CN=Users,DC=novacard,DC=local, CN=SoftDev_GLOBAL,CN=Users,DC=novacard,DC=local, cn=cn: v_okunev}Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: Stage 2: looking up via memberOf Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: Users Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: Remote Desktop Users Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: CERTSVC_DCOM_ACCESS Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: Projects_ISO 9001_R Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: SoftDev Local Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: SoftDev_GLOBAL Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: Domain Users Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local is a member of cn: InternetProxy Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINER: Looking up group of CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: Found user v_okunev :
{displayname=displayName: Vasily Okunev, givenname=givenName: Vasily, samaccounttype=sAMAccountType: 805306368, objectclass=objectClass: top, person, organizationalPerson, user, primarygroupid=primaryGroupID: 513, objectcategory=objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=novacard,DC=local, cn=cn: v_okunev, useraccountcontrol=userAccountControl: 512, userprincipalname=userPrincipalName: v_okunev@novacard.local, distinguishedname=distinguishedName: CN=v_okunev,OU=ODIPP,OU=all_users,DC=novacard,DC=local, whenchanged=whenChanged: 20120903074123.0Z, whencreated=whenCreated: 20111114080147.0Z, objectguid=objectGUID: ??�??D?/???u�?, sn=sn: Okunev, usnchanged=uSNChanged: 53029481, usncreated=uSNCreated: 46439223, usercertificate=userCertificate: [B@c5294d, objectsid=objectSid: [B@1ab0e3, samaccountname=sAMAccountName: v_okunev, instancetype=instanceType: 4, memberof=memberOf: CN=InternetProxy,CN=Users,DC=novacard,DC=local, CN=SoftDev_GLOBAL,CN=Users,DC=novacard,DC=local, name=name: v_okunev}Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider FINE: Failed to find v_okunev in userPrincipalName. Trying sAMAccountName Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm FINE: Bound to ncfs.novacard.local:3268 Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm FINE: Binding as v_okunev@novacard.local to ldap://ncfs.novacard.local:3268/ Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm FINE: Failed to start TLS. Authentication will be done via plain-text LDAP javax.naming.CommunicationException: Remote host closed connection during handshake [Root exception is javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake] at com.sun.jndi.ldap.LdapCtx.extendedOperation(Unknown Source) at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DesciprotrImpl.bind(ActiveDirectorySecurityRealm.java:413) at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DesciprotrImpl.bind(ActiveDirectorySecurityRealm.java:357) at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:245) at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:190) at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:134) at org.acegisecurity.providers.dao.AbstractUserDetailsAuthenticationProvider.authenticate(AbstractUserDetailsAuthenticationProvider.java:119) at org.acegisecurity.providers.ProviderManager.doAuthentication(ProviderManager.java:195) at org.acegisecurity.AbstractAuthenticationManager.authenticate(AbstractAuthenticationManager.java:45) at org.acegisecurity.ui.webapp.AuthenticationProcessingFilter.attemptAuthentication(AuthenticationProcessingFilter.java:71) at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:252) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:173) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:63) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249) at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66) at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87) at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76) at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164) at winstone.FilterConfiguration.execute(FilterConfiguration.java:194) at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366) at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:50) at winstone.FilterConfiguration.execute(FilterConfiguration.java:194) at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366) at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81) at winstone.FilterConfiguration.execute(FilterConfiguration.java:194) at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366) at winstone.RequestDispatcher.forward(RequestDispatcher.java:331) at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:215) at winstone.RequestHandlerThread.run(RequestHandlerThread.java:138) at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77) at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang.Thread.run(Unknown Source) Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(Unknown Source) at com.sun.net.ssl.internal.ssl.AppOutputStream.write(Unknown Source) at java.io.BufferedOutputStream.flushBuffer(Unknown Source) at java.io.BufferedOutputStream.flush(Unknown Source) at com.sun.jndi.ldap.Connection.writeRequest(Unknown Source) at com.sun.jndi.ldap.LdapClient.extendedOp(Unknown Source) ... 39 more Caused by: java.io.EOFException: SSL peer shut down incorrectly at com.sun.net.ssl.internal.ssl.InputRecord.read(Unknown Source) ... 47 more Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm FINE: Connecting to ldap://ncfs.novacard.local:3268/ Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm FINE: _gc._tcp.novacard.local resolved to [ncfs.novacard.local:3268] Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm FINE: SRV record found: 0 100 3268 ncfs.novacard.local. Sep 7, 2012 3:47:23 PM hudson.plugins.active_directory.ActiveDirectorySecurityRealm FINE: Attempting to resolve _gc._tcp.novacard.local to SRV record
Server with LDAP do not use SSL. What should I do in that way?
- environment:
Windows Server 2003
1 attachment
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in ActiveDirectorySecurityRealm.java at the bind calls shown in the stack trace, especially lines 357 and 413, and trace the plain LDAP and StartTLS connection paths. Reproduce authentication against the non-SSL LDAP endpoint described in the logs, then verify that the expected authentication path completes without the reported handshake failure.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100