[JENKINS-10349] unable to log in via LDAP but retry is successful

We are using LDAP authentication.

When user tries to log in, there is a long pause, perhaps 30 seconds, then user receives an error that they could not log in. A second attempt is always successful.

I did some tracking, and discovered this was an issue in an old Tomcat release. The issue for Tomcat is that the LDAP connection would time out and become unusable. When the user got the error, Tomcat would delete the connection, and a new attempt to login caused a new connection to LDAP to be created and login was successful. Tomcat solved the problem by detecting the timeout, and automatically dropping the connection and starting a new connection. The user still sees the delay, but does not have to enter credentials a second time.

Using Jenkins (and previously Hudson) with LDAP has the same issue. I verified that the issue does not exist if I run Jenkins as a war in a Tomcat container. It would be nice if the winstone container could pick up the fix that the Tomcat team used.

---
Originally reported by roostergx, imported from: unable to log in via LDAP but retry is successful

• status: Open
  
• priority: Minor
  
• component(s): ldap-plugin
  
• label(s): authentication
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-09
  

Raw content of original issue

We are using LDAP authentication.


When user tries to log in, there is a long pause, perhaps 30 seconds, then user receives an error that they could not log in.  A second attempt is always successful.


I did some tracking, and discovered this was an issue in an old Tomcat release.  The issue for Tomcat is that the LDAP connection would time out and become unusable.  When the user got the error, Tomcat would delete the connection, and a new attempt to login caused a new connection to LDAP to be created and login was successful.  Tomcat solved the problem by detecting the timeout, and automatically dropping the connection and starting a new connection.  The user still sees the delay, but does not have to enter credentials a second time.


Using Jenkins (and previously Hudson) with LDAP has the same issue.  I verified that the issue does not exist if I run Jenkins as a war in a Tomcat container.  It would be nice if the winstone container could pick up the fix that the Tomcat team used.

• environment: running as jar using winstone server

Start by examining the winstone container's LDAP connection behavior and comparing it with the Tomcat behavior described in the issue. Reproduce an LDAP connection timeout and verify that the first login attempt succeeds without requiring the user to enter credentials again.

Written by the indexing model from the issue text.