[JENKINS-41914] Basic authentication with group membership strategy and FreeIPA

We use kerberos-sso, ldap plugin, and role strategy for authentication and authorization.

A freeipa is configured as ldap server.

Authorization work well with kerberos login. However, with basic authentication, ldap plugin doesn't return indirect groups of user for authorization.

Attached files:

test.groovy: script for check return authorities of login

ldap-plugin.conf: a part of ldap plugin config

0001-Fix-bug-basic-authentication-can-t-work-with-group-m.patch: a temporary solution

---
Originally reported by ptt_mt0003, imported from: Basic authentication with group membership strategy and FreeIPA

• assignee: t_westling
  
• status: Open
  
• priority: Major
  
• component(s): ldap-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 3
  
• imported: 2025-12-09
  

Raw content of original issue

We use kerberos-sso, ldap plugin, and role strategy for authentication and authorization.


A freeipa is configured as ldap server.


Authorization work well with kerberos login. However, with basic authentication, ldap plugin doesn't return indirect groups of user for authorization.


Attached files:

test.groovy: script for check return authorities of login

ldap-plugin.conf: a part of ldap plugin config

0001-Fix-bug-basic-authentication-can-t-work-with-group-m.patch: a temporary solution

3 attachments

- [0001-Fix-bug-basic-authentication-can-t-work-with-group-m.patch](https://issues.jenkins.io/secure/attachment/35871/0001-Fix-bug-basic-authentication-can-t-work-with-group-m.patch)
- [ldap-plugin.conf](https://issues.jenkins.io/secure/attachment/35873/ldap-plugin.conf)
- [test.groovy](https://issues.jenkins.io/secure/attachment/35872/test.groovy)

Start by reviewing the attached test.groovy, ldap-plugin.conf, and temporary patch, then compare the basic-authentication and Kerberos login behavior described in the issue. Done means indirect FreeIPA group membership is returned for basic authentication and the authority check in test.groovy succeeds.

Written by the indexing model from the issue text.