[JENKINS-69683] Active directory 'Test Domain' does not take into account changes in the `Require TLS` checkbox.

Configure hudson.plugins.active_directory logger in the System logs to debug the Active Directory.

Go to JENKINS_URL/configureSecurity

Select Active directory in Security Realm 

Setup your AD configuration

Require TLS checkbox is activated by default.

Click on Test-Domain

The logger shows: Connecting to ldaps://mydlapserver

 

Uncheck the Require TLS checkbox.

Click on Test-Domain

The logger shows: Connecting to ldaps://mydlapserver

 

If you save the configuration, with Require TLS disabled, 

the correct TLS setting will be saved and Jenkins will use ldap://

 

If you back to JENKINS_URL/configureSecurity and click on 'Test-Domain', with 'Require TLS' still disabled, the test will be properly done with  ldap://

But if you enable Require TLS, and click on Test-Domain the test will incorrectly be performed with ldap:// instead of ldaps://

 

---
Originally reported by blatinville, imported from: Active directory 'Test Domain' does not take into account changes in the `Require TLS` checkbox.

• assignee: fbelzunc
  
• status: In Progress
  
• priority: Minor
  
• component(s): active-directory-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-07
  

Raw content of original issue

Configure hudson.plugins.active_directory logger in the System logs to debug the Active Directory.


Go to JENKINS_URL/configureSecurity


Select Active directory in Security Realm 


Setup your AD configuration


Require TLS checkbox is activated by default.


Click on Test-Domain


The logger shows: Connecting to ldaps://mydlapserver


 


Uncheck the Require TLS checkbox.


Click on Test-Domain


The logger shows: Connecting to ldaps://mydlapserver


 


If you save the configuration, with Require TLS disabled, 

the correct TLS setting will be saved and Jenkins will use ldap://


 


If you back to JENKINS_URL/configureSecurity and click on 'Test-Domain', with 'Require TLS' still disabled, the test will be properly done with  ldap://

But if you enable Require TLS, and click on Test-Domain the test will incorrectly be performed with ldap:// instead of ldaps://


 

• environment: Jenkins 2.346.3 active-directory-plugin 2.26

Start at the Test-Domain flow reached from JENKINS_URL/configureSecurity and inspect how the active-directory plugin reads the Require TLS checkbox. Use the hudson.plugins.active_directory logger to reproduce the ldap:// versus ldaps:// behavior; done means the test connection uses the current checkbox value without saving the configuration.

Written by the indexing model from the issue text.