[JENKINS-34253] Add "Require encrypted authentication" option for StartTLS

Please strongly consider adding a configuration option that disables "fall back to non-TLS LDAP if StartTLS doesn't work" behavior.

Testing that one's certificates are configured properly and that StartTLS works right now (your ldapsearch wiki examples) proves nothing about tomorrow.

[ ] Fallback to unencrypted authentication of TLS upgrade fails

or

[ * ] Require encrypted authentication

---
Originally reported by jblaine, imported from: Add "Require encrypted authentication" option for StartTLS

• assignee: fbelzunc
  
• status: Open
  
• priority: Major
  
• component(s): active-directory-plugin
  
• label(s): security, starttls
  
• resolution: Unresolved
  
• votes: 3
  
• watchers: 6
  
• imported: 2025-12-07
  

Please strongly consider adding a configuration option that disables "fall back to non-TLS LDAP if StartTLS doesn't work" behavior.


Testing that one's certificates are configured properly and that StartTLS works right now (your ldapsearch wiki examples) proves nothing about tomorrow.


[ ] Fallback to unencrypted authentication of TLS upgrade fails


or


[ * ] Require encrypted authentication

Start by locating the active-directory-plugin code that handles LDAP StartTLS and fallback authentication. Check how the current connection behavior is configured, then add coverage for the requested encrypted-authentication choice; done means unencrypted fallback is disabled when that choice is enabled while existing behavior remains available otherwise.

Written by the indexing model from the issue text.