[JIRA] (JENKINS-61761) LDAP not matching groups with different base dn as user

[cjp...@yahoo.com (JIRA)]

Title: Message Title

Topher Perusse updated an issue   Jenkins / JENKINS-61761 LDAP not matching groups with different base dn as user Change By: Topher Perusse We have a pretty large company that has users create created in different domains and user groups in a single domain. When we attempt to do user grouping, if the users base dn doesn't match the group dn, the group won't match to the user. We try to manage access all via a single (largely nested) ldap group. What I observe: User 1: CN=UserName1,OU=Users,OU=SomePlace,dc=foo,DC=company,DC=com User 2: CN=UserName2,OU=Users,OU=SomeOtherPlace,dc=bar,DC=company,DC=com Group 1: CN=MyBigGroup,OU=Distribution Lists,DC=foo,DC=company,DC=com Group 2: CN=MyNestedGroup,OU=Distribution Lists,DC=foo,DC=company,DC=com User 1 and User 2 are a members of "MyNestedGroup".  Here is my ldap config: Server: ldap://server.company.com:3268 Root DN: DC=company,DC=com User Search Base: <empty> User Search Filter: sAMAccountName=\{0} Group Search Base: <empty> Group Search Filter: (&(cn=\{0})(objectclass=group)) Group Membership: (Search for LDAP groups containing user) Group Membership Filter: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:=\{0})) When I search for "UserName1" it matches to MyNestedGroup and MyBigGroup, when I search for "UserName2" it doesn't match to any groups. Am I doing something wrong with my queries/filters or is this a bug in the ldap-plugin? *Note, when I do "Parse user attribute for list of LDAP groups" instead, I see "MyNestedGgroup" for both users (no matches to MyBigGroup, which is expected as not reverse lookup appears to be done here)   Add Comment   This message was sent by Atlassian Jira (v7.13.12#713012-sha1:6e07c38) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.205598.1585695630000.3852.1585695720111%40Atlassian.JIRA.