[JENKINS-27756] Rework ActiveDirectorySecurityRealm config UI

AD plugin has two vastly different implementations. One is based on ADSI (let's call this "ADSI mode") and the other is based on JNDI LDAP calls (let's call this "LDAP mode".) ADSI mode is only available when master is running on Windows.

When ADSI mode is possible, the plugin offers a different set of configuration options. This UI has a several problem.

• UI doesn't make it obvious that setting the domain name results in switching to the LDAP mode.


• When you implicitly choose LDAP mode by specifying a custom domain name, you should get all the configuration options of the LDAP mode, but you don't. See JENKINS-24960 and JENKINS-22727 for how this impacts users.

---
Originally reported by kohsuke, imported from: Rework ActiveDirectorySecurityRealm config UI

• status: Open
  
• priority: Major
  
• component(s): active-directory-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-07
  

AD plugin has two vastly different implementations. One is based on ADSI (let's call this "ADSI mode") and the other is based on JNDI LDAP calls (let's call this "LDAP mode".) ADSI mode is only available when master is running on Windows.


When ADSI mode is possible, the plugin offers a different set of configuration options. This UI has a several problem.




	
UI doesn't make it obvious that setting the domain name results in switching to the LDAP mode.

	
When you implicitly choose LDAP mode by specifying a custom domain name, you should get all the configuration options of the LDAP mode, but you don't. See JENKINS-24960 and JENKINS-22727 for how this impacts users.

No file or test is named. Start by locating the ActiveDirectorySecurityRealm configuration UI and the ADSI/LDAP mode selection, then compare the options exposed in each mode. Done means the UI clearly explains the mode change and exposes all LDAP configuration options when a custom domain selects LDAP mode.

Written by the indexing model from the issue text.