[JENKINS-60728] Two active directory domains and same usernames

In two AD-domains configuration (adom.organization.com, ddom.organization.com, binding as different users) when exist same user in both domains with different passwords, logon to Jenkins as user of ddom domain:

DDOM\user, ddom\user or user@​ddom.organization.com

initiate in log

 

... hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Credential exception trying to authenticate against adom.organization.com domain

org.acegisecurity.BadCredentialsException: Either no such user '...' or incorrect password

 

and after some logons, adom\user account from another domain ADOM being locked due to multiple bad password attempts.

I think it happens because authentication go though all list of configured domains(tcpdump show connects to all domains).

It is possible to initiate authentification of ddom\user only in home domain ddom.organization.com?

---
Originally reported by alexanderu, imported from: Two active directory domains and same usernames

• assignee: fbelzunc
  
• status: Open
  
• priority: Major
  
• component(s): active-directory-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-07
  

Raw content of original issue

In two AD-domains configuration (adom.organization.com, ddom.organization.com, binding as different users) when exist same user in both domains with different passwords, logon to Jenkins as user of ddom domain:


DDOM\user, ddom\user or user@ddom.organization.com


initiate in log


 



... hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider retrieveUser

WARNING: Credential exception trying to authenticate against adom.organization.com domain

org.acegisecurity.BadCredentialsException: Either no such user '...' or incorrect password





 


and after some logons, adom\user account from another domain ADOM being locked due to multiple bad password attempts.


I think it happens because authentication go though all list of configured domains(tcpdump show connects to all domains).


It is possible to initiate authentification of ddom\user only in home domain ddom.organization.com?

• environment: Jenkins 2.176.4, active-directory-plugin 2.16, two AD domains

Start at the ActiveDirectoryUnixAuthenticationProvider retrieveUser entry point named in the log and inspect how configured domains are tried for DDOM\user and user@ddom.organization.com. Reproduce the two-domain case with duplicate usernames and review the authentication tests, if present. Done means credentials are sent only to the user's home domain and the other account is not locked by failed attempts.

Written by the indexing model from the issue text.