jenkinsci / jenkinsci/ldap-plugin

[JENKINS-31023] Unable to connect to LDAPS

Open
#458 1 comment 0 reactions 0 assignees View on GitHub
component:ldap-plugin imported-jira-issue priority:minor resolution:unresolved
Dominant language
Java
Stars
51
Forks
106
No merged PRs in 30d

Description

Unable to connect to LDAP server over LDAPS. LDAP works fine. Getting the below error message:

Unable to connect to ldaps://example.com:636 : javax.naming.CommunicationException: anonymous bind failed: example.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure]

javax.naming.CommunicationException: anonymous bind failed: example.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure]

at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:197)

at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740)

at com.sun.jndi.ldap.LdapCtx.(LdapCtx.java:316)

at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)

at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)

at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)

at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)

at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)

at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307)

at javax.naming.InitialContext.init(InitialContext.java:242)

at javax.naming.InitialContext.(InitialContext.java:216)

at javax.naming.directory.InitialDirContext.(InitialDirContext.java:101)

at hudson.security.LDAPSecurityRealm$DescriptorImpl.doCheckServer(LDAPSecurityRealm.java:1058)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:606)

at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:298)

at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:161)

at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:96)

at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:121)

at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)

at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:249)

at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)

at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)

at org.kohsuke.stapler.Stapler.service(Stapler.java:238)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)

at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:686)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1494)

at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)

at hudson.plugins.greenballs.GreenBallFilter.doFilter(GreenBallFilter.java:58)

at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:129)

at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:123)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:49)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)

at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:117)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)

at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)

at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)

at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)

at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1474)

at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:499)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)

at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:533)

at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)

at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1086)

at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:428)

at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193)

at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1020)

at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)

at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)

at org.eclipse.jetty.server.Server.handle(Server.java:370)

at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:489)

at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:949)

at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:1011)

at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)

at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)

at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)

at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)

at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)

at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)

at java.lang.Thread.run(Thread.java:745)

Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)

at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1991)

at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1098)

at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1344)

at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:721)

at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:122)

at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)

at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)

at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:431)

at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:404)

at com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:358)

at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:191)

... 87 more

Installed the plugin 'skip-certificate-check' which didn't resolve the problem.

Imported the certificate of the LDAP server into the cacerts keystore of Java home but still doesn't work

---
Originally reported by surfi2000, imported from: Unable to connect to LDAPS


  • status: Open
  • priority: Minor
  • component(s): ldap-plugin
  • resolution: Unresolved
  • votes: 0
  • watchers: 3
  • imported: 2025-12-09

Raw content of original issue

Unable to connect to LDAP server over LDAPS. LDAP works fine. Getting the below error message:



Unable to connect to ldaps://example.com:636 : javax.naming.CommunicationException: anonymous bind failed: example.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure]

javax.naming.CommunicationException: anonymous bind failed: example.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure]

	at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:197)

	at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740)

	at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:316)

	at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)

	at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)

	at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)

	at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)

	at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:684)

	at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:307)

	at javax.naming.InitialContext.init(InitialContext.java:242)

	at javax.naming.InitialContext.<init>(InitialContext.java:216)

	at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:101)

	at hudson.security.LDAPSecurityRealm$DescriptorImpl.doCheckServer(LDAPSecurityRealm.java:1058)

	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)

	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

	at java.lang.reflect.Method.invoke(Method.java:606)

	at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:298)

	at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:161)

	at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:96)

	at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:121)

	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)

	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

	at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:249)

	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)

	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:746)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:876)

	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:649)

	at org.kohsuke.stapler.Stapler.service(Stapler.java:238)

	at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)

	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:686)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1494)

	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:132)

	at hudson.plugins.greenballs.GreenBallFilter.doFilter(GreenBallFilter.java:58)

	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:129)

	at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:123)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:49)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)

	at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:117)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)

	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)

	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)

	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:49)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1482)

	at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)

	at org.eclipse.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1474)

	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:499)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:137)

	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:533)

	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:231)

	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1086)

	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:428)

	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:193)

	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1020)

	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:135)

	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:116)

	at org.eclipse.jetty.server.Server.handle(Server.java:370)

	at org.eclipse.jetty.server.AbstractHttpConnection.handleRequest(AbstractHttpConnection.java:489)

	at org.eclipse.jetty.server.AbstractHttpConnection.headerComplete(AbstractHttpConnection.java:949)

	at org.eclipse.jetty.server.AbstractHttpConnection$RequestHandler.headerComplete(AbstractHttpConnection.java:1011)

	at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:644)

	at org.eclipse.jetty.http.HttpParser.parseAvailable(HttpParser.java:235)

	at org.eclipse.jetty.server.AsyncHttpConnection.handle(AsyncHttpConnection.java:82)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint.handle(SelectChannelEndPoint.java:668)

	at org.eclipse.jetty.io.nio.SelectChannelEndPoint$1.run(SelectChannelEndPoint.java:52)

	at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)

	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)

	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)

	at java.lang.Thread.run(Thread.java:745)

Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

	at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

	at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)

	at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1991)

	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1098)

	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1344)

	at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:721)

	at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:122)

	at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)

	at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)

	at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:431)

	at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:404)

	at com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:358)

	at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:191)

	... 87 more



Installed the plugin 'skip-certificate-check' which didn't resolve the problem.



Imported the certificate of the LDAP server into the cacerts keystore of Java home but still doesn't work

environment

```
CentOS 6.7

Jenkins ver. 1.634
```

Contributor guide

Open the contributing guide

Research direction

Start at hudson.security.LDAPSecurityRealm$DescriptorImpl.doCheckServer, the entry point shown in the stack trace, and reproduce the LDAPS connection failure with the reported SSLHandshakeException. Review the LDAP plugin's handling of LDAPS and certificate configuration; done means the reported LDAPS connection succeeds without weakening certificate validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.