[JENKINS-14520] LDAP Plugin should support StartTLS extension

The Jenkins LDAP-Plugin doesn't support the LDAP StartTLS extension that we would need to access our LDAP server. See also this discussion on the mailing list: http://jenkins.361315.n4.nabble.com/StartTLS-td372639.html

I have investigated a bit to check what would be needed to support that feature, and it seems that the version of acegi-security that Jenkins uses is too old. Spring-ldap supports StartTls since version 1.3.0 (which is part of Spring 3.0).

I have also voted for JENKINS-5303">JENKINS-5303 to upgrade acegi-security.

---
Originally reported by jmairboeck, imported from: LDAP Plugin should support StartTLS extension

• status: In Progress
  
• priority: Major
  
• component(s): ldap-plugin
  
• resolution: Unresolved
  
• votes: 18
  
• watchers: 22
  
• imported: 2025-12-09
  

Raw content of original issue

The Jenkins LDAP-Plugin doesn't support the LDAP StartTLS extension that we would need to access our LDAP server. See also this discussion on the mailing list: http://jenkins.361315.n4.nabble.com/StartTLS-td372639.html


I have investigated a bit to check what would be needed to support that feature, and it seems that the version of acegi-security that Jenkins uses is too old. Spring-ldap supports StartTls since version 1.3.0 (which is part of Spring 3.0).


I have also voted for JENKINS-5303 to upgrade acegi-security.

Start by reviewing the LDAP plugin's current authentication setup and the Spring LDAP/Acegi dependency versions referenced in the issue. Determine the supported path for StartTLS and define tests for connecting to an LDAP server with StartTLS; done means the plugin can access such a server without regressing existing LDAP authentication.

Written by the indexing model from the issue text.