jenkinsci / jenkinsci/active-directory-plugin

PartialResultException thrown synchronously from LDAPSearchBuilder.search() escapes searchOne()'s JENKINS-42687 catch (LDAPS)

Open
#720 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
53
Forks
115
PR merge metrics
No merged PRs in 30d

Description

### Jenkins and plugins versions report

Plugin version: 2.41.2
Jenkins version: 2.574
AD transport: LDAPS
Java: 25

### What Operating System are you using (both controller, and any agents involved in the problem)?

Running in docker, alpine based image (controller and agents)

### Reproduction steps

1. Configure the Active Directory security realm with LDAPS (we use 636)
2. Login or open a build's changelog page trigger the issue
3. See stack trace on controller

### Expected Results

Per the JENKINS-42687 fix, PartialResultException encountered during an AD search should be caught and logged as a WARNING ("JENKINS-42687 The user we are looking for might exist")

### Actual Results

The exception is not caught:

javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name 'DC=,DC='
at java.naming/com.sun.jndi.ldap.LdapCtx.processReturnCode(...)
at java.naming/com.sun.jndi.ldap.LdapCtx.searchAux(...)
at java.naming/com.sun.jndi.ldap.LdapCtx.c_search(...)
at java.naming/com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(...)
at javax.naming.directory.InitialDirContext.search(...)
at hudson.plugins.active_directory.LDAPSearchBuilder.search(LDAPSearchBuilder.java:120)
at hudson.plugins.active_directory.LDAPSearchBuilder.searchOne(LDAPSearchBuilder.java:85)
at hudson.plugins.active_directory.ActiveDirectoryUnixAuthenticationProvider.retrieveUser(ActiveDirectoryUnixAuthenticationProvider.java:384)
...

### Anything else?

_No response_

### Are you interested in contributing a fix?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reading LDAPSearchBuilder.java around searchOne() and search(), then trace the call from ActiveDirectoryUnixAuthenticationProvider.retrieveUser(). Reproduce the LDAPS search failure described in the issue and verify that PartialResultException is handled as expected, with the JENKINS-42687 warning rather than escaping synchronously.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.