[JENKINS-75237] Saving the security configuration form changes the Active Directory password in config.xml

When saving the security configuration, the already encrypted Active Directory password of the Jenkins config.xml was re-encrypted. As a result, the account could no longer connect to the domain and all users no longer had access to the Jenkins Server. In addition, a port was added to the address.

We had to import a backup to be able to use Jenkins again.

---
Originally reported by tea_steffen, imported from: Saving the security configuration form changes the Active Directory password in config.xml

• assignee: fbelzunc
  
• status: Open
  
• priority: Minor
  
• component(s): active-directory-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 3
  
• imported: 2025-12-07
  

Raw content of original issue

When saving the security configuration, the already encrypted Active Directory password of the Jenkins config.xml was re-encrypted. As a result, the account could no longer connect to the domain and all users no longer had access to the Jenkins Server. In addition, a port was added to the address.

We had to import a backup to be able to use Jenkins again.

• environment: Jenkins Version 2.479.3 running on Debian Bookworm.

4 attachments

- [Bild (2).png](https://issues.jenkins.io/secure/attachment/63913/Bild%20%282%29.png)
> 
- [config.xml.orginal](https://issues.jenkins.io/secure/attachment/63939/config.xml.orginal)
- [config.xml.save_change_in_group](https://issues.jenkins.io/secure/attachment/63938/config.xml.save_change_in_group)
- [config.xml.save_no_change_in_group](https://issues.jenkins.io/secure/attachment/63937/config.xml.save_no_change_in_group)

Start by comparing config.xml.orginal with config.xml.save_change_in_group and config.xml.save_no_change_in_group, then trace the active-directory-plugin security configuration save flow. Done means saving the form no longer re-encrypts the existing Active Directory password or unexpectedly adds a port to the address, while preserving domain access.

Written by the indexing model from the issue text.