[JIRA] (JENKINS-60443) LDAP Plugin Ignores Group Search Filter

[julianwissm...@gmail.com (JIRA)]

Title: Message Title

Julian Wissmann created an issue   Jenkins / JENKINS-60443 LDAP Plugin Ignores Group Search Filter Issue Type: Bug Assignee: Unassigned Components: ldap-plugin Created: 2019-12-11 14:36 Environment: LDAP Plugin 1.20 and newer Role Based Authorization Strategy 2.13 and later Jenkins 2.60 and later Labels: plugin security configuration Priority: Major Reporter: Julian Wissmann When configuring a Group Serch Filter in Jenkins it is not evaluated. Step-Debugging the Plugin reveals that the AuthoritiesPopulatorImpl holds the default value in groupSearchFilter. Setting a Group memberhsip filter causes the groupSearchFilter Field in AuthoritiesPopulatorImpl to hold the Group membership filter.   Our Group configuration in LDAP is a tree following this schema: ou:Project ---> ou:Tool ---> cn: posixGroup We use Group Search Filters to match the correct ou to search Groups having the same Groupname may exist in other tool OUs. The filter used is (ou:dn:=ci) as the Tools ou we host our Jenkins groups in is called ci. Having a group admin in this ou and having a group admin in another ou causes that other Group to also be matched.    My discovery is, that with a Group Search Filter set in the LDAP Configuration, the AuthoritiesPopulatorImpl holds the Filter "(| (member={0}) (uniqueMember={0}) (memberUid={1}))" in the groupSearchFilter field. As a fix I was able to set the Group membership filter to "(&(ou:dn:=ci)(memberUid={1}))".   Possible fixes: Either drop the Group search filter field entirely as it seems disused or restore usage of this field Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.203518.1576074992000.5576.1576075020106%40Atlassian.JIRA.