[JENKINS-63303] AD plugin should use tokenGroups by default

The AD plugin uses `AUTO` by default for its groupLookup.

however this has a performance hit and many users do not need this functionality.

Security should be enforced by `SecurityGroups`, thus we should default to only `tokenGroups` rather than auto (or auto should default to tokengroup lookup first - but that may break existing installations).

That way users will not get a slow experience of logging in and authentication lookup that often plagues jenkins with AD setups by default (they will have to opt into it!)

---
Originally reported by teilo, imported from: AD plugin should use tokenGroups by default

• assignee: fbelzunc
  
• status: In Progress
  
• priority: Minor
  
• component(s): active-directory-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-07
  

Raw content of original issue

The AD plugin uses `AUTO` by default for its groupLookup.


however this has a performance hit and many users do not need this functionality.


Security should be enforced by `SecurityGroups`, thus we should default to only `tokenGroups` rather than auto (or auto should default to tokengroup lookup first - but that may break existing installations).


That way users will not get a slow experience of logging in and authentication lookup that often plagues jenkins with AD setups by default (they will have to opt into it!)

Start at the active-directory-plugin entry point that handles the groupLookup setting, and compare the existing AUTO and tokenGroups behavior. Review authentication and configuration tests for default-value and installation-compatibility coverage. Done means the default avoids the unnecessary lookup while preserving an explicit opt-in for users who need it.

Written by the indexing model from the issue text.