[JENKINS-40541] Ldap group membership doenst work

I'm having troubles configuring jenkins with ldap groupmembership filter, is like it isn't filter.

I can see that the groups is filter correctly:

Group search filter: (objectClass=mycompPermissions)(tValue=

{0}) -> this filter works , I can see the groups in the section "assign roles"



but when a user is logged in, jenkins is not able to detect what group it belong, this is my filter:



(objectClass=mycompPermissions)(equivalentToMe=cn={0}

,ou=people,ou=users,o=Company)

if I replace cn=

{0}

, with a specific user , it doesn't work neither. I tested the filter with ApacheDirectoryStudio and it worked there. if I go to jenkinsurl/whoAmI/

I can see:

Name: user1 IsAuthenticated?: true Authorities:

"authenticated"

So:

I'm able to login with jenkins with my ldapuser

Jenkins Is able to list the ldap groups

the problem is:

Jenkins is not able to detect what group belong each user

---
Originally reported by estev82, imported from: Ldap group membership doenst work

• status: Open
  
• priority: Blocker
  
• component(s): ldap-plugin
  
• resolution: Unresolved
  
• votes: 1
  
• watchers: 4
  
• imported: 2025-12-09
  

Raw content of original issue

I'm having troubles configuring jenkins with ldap groupmembership filter, is like it isn't filter.


I can see that the groups is filter correctly:


Group search filter: (objectClass=mycompPermissions)(tValue=

{0}) -> this filter works , I can see the groups in the section "assign roles"


but when a user is logged in, jenkins is not able to detect what group it belong, this is my filter:

(objectClass=mycompPermissions)(equivalentToMe=cn={0}

,ou=people,ou=users,o=Company)


if I replace cn=

{0}

 , with a specific user , it doesn't work neither. I tested the filter with ApacheDirectoryStudio and it worked there. if I go to jenkinsurl/whoAmI/


I can see:


Name: user1 IsAuthenticated?: true Authorities:

"authenticated"


So:


I'm able to login with jenkins with my ldapuser

Jenkins Is able to list the ldap groups

the problem is:


Jenkins is not able to detect what group belong each user

Start with the ldap-plugin configuration and the /whoAmI/ endpoint, reproducing the supplied group search and membership filters while comparing the groups shown in “assign roles” with the user’s authorities. Trace the group-membership handling to determine why the authenticated user receives only “authenticated”; done means the expected LDAP group appears in the user’s authorities.

Written by the indexing model from the issue text.