jenkinsci / jenkinsci/active-directory-plugin

[JENKINS-34426] Changing project-based settings for AD-Groups shows error

Open
#476 32 comments 0 reactions 0 assignees View on GitHub
component:active-directory-plugin imported-jira-issue priority:critical resolution:unresolved
Dominant language
Java
Stars
53
Forks
115
No merged PRs in 30d

Description

After upgrading Active Directory plugin ver. 1.43 to 1.44 we get a message "Failed to test the validity of the user name ..." on project based matrix settings, because our LDAP users and groups cannot be verified anymore.

We have an AD-Setup with an entered domain only (in v1.43 this was enough) and the "Test" button returns "success"

Do we have to configure something elses after the latest release?

hudson.plugins.active_directory.CacheAuthenticationException: Authentication failed caching user ; nested exception is com.google.common.util.concurrent.UncheckedExecutionException: java.lang.IllegalStateException: Recursive load

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:194)

	at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:54)

	at hudson.plugins.active_directory.ActiveDirectorySecurityRealm.loadUserByUsername(ActiveDirectorySecurityRealm.java:731)

	at hudson.security.GlobalMatrixAuthorizationStrategy$DescriptorImpl.doCheckName_(GlobalMatrixAuthorizationStrategy.java:336)

	at hudson.security.GlobalMatrixAuthorizationStrategy$DescriptorImpl.doCheckName(GlobalMatrixAuthorizationStrategy.java:314)

	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

	at java.lang.reflect.Method.invoke(Method.java:606)

	at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:320)

	at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:163)

	at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:96)

	at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:124)

	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)

	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

	at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:233)

	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)

	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)

	at org.kohsuke.stapler.Stapler.service(Stapler.java:238)

	at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)

	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:686)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1494)

	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:135)

	at hudson.plugins.greenballs.GreenBallFilter.doFilter(GreenBallFilter.java:59)

	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)

	at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:126)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:49)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)

	at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:117)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)

	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)

	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1474)

	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:499)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)

	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:533)

	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)

	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1086)

	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:428)

	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193)

	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1020)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)

	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)

	at org.eclipse.jetty.server.Server.handle(Server.java:370)

	at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:489)

	at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:949)

	at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:1011)

	at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)

	at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)

	at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)

	at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)

	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)

	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)

	at java.lang.Thread.run(Thread.java:724)

Caused by: com.google.common.util.concurrent.UncheckedExecutionException: java.lang.IllegalStateException: Recursive load

	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2234)

	at com.google.common.cache.LocalCache.get(LocalCache.java:3965)

	at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4764)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:136)

	... 79 more

Caused by: java.lang.IllegalStateException: Recursive load

	at com.google.common.base.Preconditions.checkState(Preconditions.java:145)

	at com.google.common.cache.LocalCache$Segment.waitForLoadingValue(LocalCache.java:2330)

	at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2320)

	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2228)

	at com.google.common.cache.LocalCache.get(LocalCache.java:3965)

	at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4764)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:302)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:269)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.access$100(ActiveDirectoryUnixAuthenticationProvider.java:72)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider$1.call(ActiveDirectoryUnixAuthenticationProvider.java:147)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider$1.call(ActiveDirectoryUnixAuthenticationProvider.java:136)

	at com.google.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4767)

	at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3568)

	at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2350)

	at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2313)

	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2228)

	... 82 more

---
Originally reported by zioschild, imported from: Changing project-based settings for AD-Groups shows error


  • assignee: fbelzunc
  • status: Reopened
  • priority: Critical
  • component(s): active-directory-plugin
  • resolution: Unresolved
  • votes: 14
  • watchers: 23
  • imported: 2025-12-07

Raw content of original issue

After upgrading Active Directory plugin ver. 1.43 to 1.44 we get a message "Failed to test the validity of the user name ..." on project based matrix settings, because our LDAP users and groups cannot be verified anymore.

We have an AD-Setup with an entered domain only (in v1.43 this was enough) and the "Test" button returns "success"



Do we have to configure something elses after the latest release?





hudson.plugins.active_directory.CacheAuthenticationException: Authentication failed caching user <here the user/group>; nested exception is com.google.common.util.concurrent.UncheckedExecutionException: java.lang.IllegalStateException: Recursive load

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:194)

	at hudson.plugins.active_directory.AbstractActiveDirectoryAuthenticationProvider.loadUserByUsername(AbstractActiveDirectoryAuthenticationProvider.java:54)

	at hudson.plugins.active_directory.ActiveDirectorySecurityRealm.loadUserByUsername(ActiveDirectorySecurityRealm.java:731)

	at hudson.security.GlobalMatrixAuthorizationStrategy$DescriptorImpl.doCheckName_(GlobalMatrixAuthorizationStrategy.java:336)

	at hudson.security.GlobalMatrixAuthorizationStrategy$DescriptorImpl.doCheckName(GlobalMatrixAuthorizationStrategy.java:314)

	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

	at java.lang.reflect.Method.invoke(Method.java:606)

	at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:320)

	at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:163)

	at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:96)

	at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:124)

	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)

	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

	at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:233)

	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)

	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)

	at org.kohsuke.stapler.Stapler.service(Stapler.java:238)

	at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)

	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:686)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1494)

	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:135)

	at hudson.plugins.greenballs.GreenBallFilter.doFilter(GreenBallFilter.java:59)

	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)

	at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:126)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:49)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)

	at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:117)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)

	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)

	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1474)

	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:499)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)

	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:533)

	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)

	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1086)

	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:428)

	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193)

	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1020)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)

	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)

	at org.eclipse.jetty.server.Server.handle(Server.java:370)

	at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:489)

	at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:949)

	at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:1011)

	at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)

	at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)

	at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)

	at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)

	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)

	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)

	at java.lang.Thread.run(Thread.java:724)

Caused by: com.google.common.util.concurrent.UncheckedExecutionException: java.lang.IllegalStateException: Recursive load

	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2234)

	at com.google.common.cache.LocalCache.get(LocalCache.java:3965)

	at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4764)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:136)

	... 79 more

Caused by: java.lang.IllegalStateException: Recursive load

	at com.google.common.base.Preconditions.checkState(Preconditions.java:145)

	at com.google.common.cache.LocalCache$Segment.waitForLoadingValue(LocalCache.java:2330)

	at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2320)

	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2228)

	at com.google.common.cache.LocalCache.get(LocalCache.java:3965)

	at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4764)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:302)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:269)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.access$100(ActiveDirectoryUnixAuthenticationProvider.java:72)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider$1.call(ActiveDirectoryUnixAuthenticationProvider.java:147)

	at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider$1.call(ActiveDirectoryUnixAuthenticationProvider.java:136)

	at com.google.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4767)

	at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3568)

	at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2350)

	at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2313)

	at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2228)

	... 82 more

environment

```
Windows 2012 Server

Jenkins ver. 1.656

Active Directory plugin ver. 1.44
```

Contributor guide

Open the contributing guide

Research direction

Start with ActiveDirectoryUnixAuthenticationProvider.java at retrieveUser lines 136, 194, and 302, then follow GlobalMatrixAuthorizationStrategy.doCheckName. Reproduce the project-based matrix check after upgrading from Active Directory plugin 1.43 to 1.44 using the domain-only setup. Done means LDAP users and groups can again be verified without the Recursive load error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.