[JENKINS-38560] Could not login to Jenkins with user account having restrictions for workstations

When a user is restricted to workstations in AD (userWorkstations), even when he is logged in at one of this workstations, he could not login jenkins or start a slave.

If we remove the restrictions on the user account and allow "ALL" then we are able to login to Jenkins. But our security team is not willing to make it as a permanent solution and we need to fix this issue as soon as possible because security team will again apply the restrictions.

We are facing the issue after the last upgrade of Jenkins server version to 2.7.4.

---
Originally reported by vinaybondugula, imported from: Could not login to Jenkins with user account having restrictions for workstations

• assignee: fbelzunc
  
• status: Open
  
• priority: Critical
  
• component(s): active-directory-plugin
  
• label(s): jenkins
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-07
  

Raw content of original issue

When a user is restricted to workstations in AD (userWorkstations), even when he is logged in at one of this workstations, he could not login jenkins or start a slave.


If we remove the restrictions on the user account and allow "ALL" then we are able to login to Jenkins. But our security team is not willing to make it as a permanent solution and we need to fix this issue as soon as possible because security team will again apply the restrictions.


We are facing the issue after the last upgrade of Jenkins server version to 2.7.4.

• environment: Win 7/WIN 10, Jenkins version 2.7.4

1 attachment

- [Jenkins_loginerror.JPG](https://issues.jenkins.io/secure/attachment/34114/Jenkins_loginerror.JPG)
> 

Start by reproducing the failure in the active-directory-plugin with a user restricted by AD userWorkstations, using the stated Windows and Jenkins 2.7.4 environment. Compare login and slave-start behavior when the restriction is removed; done means both operations work while the workstation restriction remains enabled.

Written by the indexing model from the issue text.