[JENKINS-22727] AD plugin times out for large user/group membership

Logs show that the plugin has correctly matched my username against the right DC and authenticated correctly. All my groups are printed along with some additional ldap content. Then there's a two minute gap in the logs around Stage 2:

```
Apr 22, 2014 11:46:27 PM FINE hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
Stage 2: looking up via memberOf
Apr 22, 2014 11:48:27 PM FINE hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider
CN=Jon Wiswall,OU=,OU=,DC=,DC=,DC=,DC= is a member of cn:

```

After the 2-minute break the log prints the first 20 or so of my ~150 group memberships.

Looks like the LDAP server gives up at this point:

```
Failed to retrieve user information for
javax.naming.TimeLimitExceededException: [LDAP: error code 3 - Timelimit Exceeded]; remaining name 'DC=,DC=,DC=,DC='
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapNamingEnumeration.getNextBatch(Unknown Source)
at com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreImpl(Unknown Source)
at com.sun.jndi.ldap.LdapNamingEnumeration.hasMore(Unknown Source)
at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.parseMembers(ActiveDirectoryUnixAuthenticationProvider.java:456)

```

... which then fails the Jenkins login with an authentication failed message.

I'm sure this is to do with our large Active Directory deployment.

Could the plugin only check the username/pw combo, and then if matrix or project-based security is enabled, check if the named groups are present? The initial auth step (which dumps all the groups anyhow) is super fast.

(Note: marked bug as 'minor' but I can't really point my team at my Jenkins instance until this works.)

---
Originally reported by jdwiswall, imported from: AD plugin times out for large user/group membership

• status: Open
  
• priority: Minor
  
• component(s): active-directory-plugin
  
• resolution: Unresolved
  
• votes: 4
  
• watchers: 8
  
• imported: 2025-12-07
  

Raw content of original issue

Logs show that the plugin has correctly matched my username against the right DC and authenticated correctly.  All my groups are printed along with some additional ldap content.  Then there's a two minute gap in the logs around Stage 2:




Apr 22, 2014 11:46:27 PM FINE hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider

Stage 2: looking up via memberOf

Apr 22, 2014 11:48:27 PM FINE hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider

CN=Jon Wiswall,OU=<ou>,OU=<ou>,DC=<dc>,DC=<dc>,DC=<dc>,DC=<dc> is a member of cn: <group name>





After the 2-minute break the log prints the first 20 or so of my ~150 group memberships.


Looks like the LDAP server gives up at this point:




Failed to retrieve user information for <username>

javax.naming.TimeLimitExceededException: [LDAP: error code 3 - Timelimit Exceeded]; remaining name 'DC=<dc>,DC=<dc>,DC=<dc>,DC=<dc>'

	at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)

	at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)

	at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)

	at com.sun.jndi.ldap.LdapNamingEnumeration.getNextBatch(Unknown Source)

	at com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreImpl(Unknown Source)

	at com.sun.jndi.ldap.LdapNamingEnumeration.hasMore(Unknown Source)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.parseMembers(ActiveDirectoryUnixAuthenticationProvider.java:456)





... which then fails the Jenkins login with an authentication failed message.


I'm sure this is to do with our large Active Directory deployment.


Could the plugin only check the username/pw combo, and then if matrix or project-based security is enabled, check if the named groups are present?  The initial auth step (which dumps all the groups anyhow) is super fast.


(Note: marked bug as 'minor' but I can't really point my team at my Jenkins instance until this works.)

• environment: AD plugin v1.37, Jenkins 1.56, Running as a service, Windows Server 2012 R2, Active Directory with multiple domains

Start with ActiveDirectoryUnixAuthenticationProvider.java, especially parseMembers at line 456, and reproduce the timeout using the reported large group membership and multi-domain Active Directory environment. Trace the Stage 2 member lookup and define completion as successful authentication without the LDAP time-limit failure; the issue does not identify a test file.

Written by the indexing model from the issue text.