jenkinsci / jenkinsci/active-directory-plugin

[JENKINS-36647] Active Directory Plugin Fails with No SRV record found message

Open
#494 0 comments 0 reactions 0 assignees View on GitHub
component:active-directory-plugin imported-jira-issue priority:critical resolution:unresolved
Dominant language
Java
Stars
53
Forks
115
No merged PRs in 30d

Description

We setup Jenkins on AWS Linux EC2 through VPC and we are trying to authenticate users against our corporate Active Directory via Active Directory plugin. I understand following ports are to be opened in firewall between EC2 and our AD server and they are opened as required.

389 (LDAP)

636 (LDAP over SSL)

3268 (Global catalog)

3269 (Global catalog over SSL

I have verified via telnet and the above ports are opened.

However we are unable to make a successful login and the error log is below. Do I need to open any other ports in firewall or make any other config changes?

javax.naming.NamingException: No SRV record found for _ldap._tcp.myhost.mycompany.com. [Root exception is javax.naming.NameNotFoundException: DNS name not found [response code 3]; remaining name '_ldap._tcp.myhost.mycompany.com.']

at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.obtainLDAPServer(ActiveDirectorySecurityRealm.java:708)

at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.doValidate(ActiveDirectorySecurityRealm.java:430)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:95)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)

at java.lang.reflect.Method.invoke(Method.java:507)

at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:324)

at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:167)

at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:100)

at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:124)

at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)

at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:233)

at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)

at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)

at org.kohsuke.stapler.Stapler.service(Stapler.java:238)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)

at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:812)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1669)

at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:135)

at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:126)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:49)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)

at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:117)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:135)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)

at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)

at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)

at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:553)

at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)

at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)

at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)

at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)

at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)

at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)

at org.eclipse.jetty.server.Server.handle(Server.java:499)

at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:311)

at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)

at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:544)

at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1153)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)

at java.lang.Thread.run(Thread.java:785)

Caused by: javax.naming.NameNotFoundException: DNS name not found [response code 3]; remaining name '_ldap._tcp.myhost.mycompany.com.'

at com.sun.jndi.dns.DnsClient.checkResponseCode(DnsClient.java:668)

at com.sun.jndi.dns.DnsClient.isMatchResponse(DnsClient.java:586)

at com.sun.jndi.dns.DnsClient.doUdpQuery(DnsClient.java:435)

at com.sun.jndi.dns.DnsClient.query(DnsClient.java:220)

at com.sun.jndi.dns.Resolver.query(Resolver.java:93)

at com.sun.jndi.dns.DnsContext.c_getAttributes(DnsContext.java:446)

at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_getAttributes(ComponentDirContext.java:247)

at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.getAttributes(PartialCompositeDirContext.java:153)

at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.getAttributes(PartialCompositeDirContext.java:141)

at javax.naming.directory.InitialDirContext.getAttributes(InitialDirContext.java:153)

at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.obtainLDAPServer(ActiveDirectorySecurityRealm.java:650)

... 69 more

---
Originally reported by sagayd, imported from: Active Directory Plugin Fails with No SRV record found message


  • assignee: fbelzunc
  • status: Open
  • priority: Critical
  • component(s): active-directory-plugin
  • resolution: Unresolved
  • votes: 1
  • watchers: 1
  • imported: 2025-12-07

Raw content of original issue

We setup Jenkins on AWS Linux EC2 through VPC and we are trying to authenticate users against our corporate Active Directory via Active Directory plugin. I understand following ports are to be opened in firewall between EC2 and our AD server and they are opened as required.

389 (LDAP) 

636 (LDAP over SSL)

3268 (Global catalog)

3269 (Global catalog over SSL



I have verified via telnet and the above ports are opened. 



However we are unable to make a successful login and the error log is below. Do I need to open any other ports in firewall or make any other config changes?



javax.naming.NamingException: No SRV record found for _ldap._tcp.myhost.mycompany.com. [Root exception is javax.naming.NameNotFoundException: DNS name not found [response code 3]; remaining name '_ldap._tcp.myhost.mycompany.com.']

	at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.obtainLDAPServer(ActiveDirectorySecurityRealm.java:708)

	at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.doValidate(ActiveDirectorySecurityRealm.java:430)

	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:95)

	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)

	at java.lang.reflect.Method.invoke(Method.java:507)

	at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:324)

	at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:167)

	at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:100)

	at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:124)

	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)

	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

	at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:233)

	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)

	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)

	at org.kohsuke.stapler.Stapler.service(Stapler.java:238)

	at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)

	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:812)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1669)

	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:135)

	at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:126)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

	at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:49)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)

	at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:117)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:135)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)

	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)

	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

	at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1652)

	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:585)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)

	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:553)

	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:223)

	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1127)

	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:515)

	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:185)

	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1061)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)

	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:97)

	at org.eclipse.jetty.server.Server.handle(Server.java:499)

	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:311)

	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:257)

	at org.eclipse.jetty.io.AbstractConnection$2.run(AbstractConnection.java:544)

	at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)

	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1153)

	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)

	at java.lang.Thread.run(Thread.java:785)

Caused by: javax.naming.NameNotFoundException: DNS name not found [response code 3]; remaining name '_ldap._tcp.myhost.mycompany.com.'

	at com.sun.jndi.dns.DnsClient.checkResponseCode(DnsClient.java:668)

	at com.sun.jndi.dns.DnsClient.isMatchResponse(DnsClient.java:586)

	at com.sun.jndi.dns.DnsClient.doUdpQuery(DnsClient.java:435)

	at com.sun.jndi.dns.DnsClient.query(DnsClient.java:220)

	at com.sun.jndi.dns.Resolver.query(Resolver.java:93)

	at com.sun.jndi.dns.DnsContext.c_getAttributes(DnsContext.java:446)

	at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_getAttributes(ComponentDirContext.java:247)

	at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.getAttributes(PartialCompositeDirContext.java:153)

	at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.getAttributes(PartialCompositeDirContext.java:141)

	at javax.naming.directory.InitialDirContext.getAttributes(InitialDirContext.java:153)

	at hudson.plugins.active_directory.ActiveDirectorySecurityRealm$DescriptorImpl.obtainLDAPServer(ActiveDirectorySecurityRealm.java:650)

	... 69 more

  • environment: RHEL7, Jenkins ver. 2.3 and Active Directory plugin ver 1.47

Contributor guide

Open the contributing guide

Research direction

Start in ActiveDirectorySecurityRealm.java at obtainLDAPServer and doValidate, the entry points named in the stack trace. Reproduce the validation failure with the reported AWS and Active Directory setup, then determine the relevant configuration or lookup behavior. Done means Active Directory authentication validates successfully without the missing SRV record error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.