Hello:
spending the last few days trying to get Jenkins to auth w/ LDAP, I'm
still stuck. After setting up my LDAP server in the Jenkins
configuration screen, when I attempt to log in, I can see that Jenkins
does a few things from the OpenLDAP log files.
1) I connect via ldaps, so the TLS connection is established
successfully and I log in using the correct manager dn.
Feb 24 13:53:20 mydomain slapd[1912]: conn=6150 fd=13 TLS established
tls_ssf=128 ssf=128
2) Jenkins then queries ldap for the user, and gets every attribute
entry for that user. I can also see this successfully happening in the
LDAP log files.
Feb 24 13:53:20 mydomain slapd[1912]: SRCH
"ou=people,dc=mydomain,dc=com" 2 3
Feb 24 13:53:20 mydomain slapd[1912]: 0 0 0
Feb 24 13:53:20 mydomain slapd[1912]: begin get_filter
Feb 24 13:53:20 mydomain slapd[1912]: EQUALITY
Feb 24 13:53:20 mydomain slapd[1912]: end get_filter 0
Feb 24 13:53:20 mydomain slapd[1912]: filter: (uid=test)
Feb 24 13:53:20 mydomain slapd[1912]: attrs:
Feb 24 13:53:20 mydomain slapd[1912]: => access_allowed: search access
to "cn=Test User+gidNumber=1000+homeDirectory=/home/test+loginShell=/
bin/bash
+shadowLastChange=15337+shadowMax=99999+shadowMin=0+shadowWarning=7+uid=test
+uidNumber=1000,ou=people,dc=mydomain,dc=com" "uid" requested
3) The part where Jenkins fails, is that it appears to do a final
search on the user using the following as a dn:
Feb 24 13:53:21 mydomain slapd[1912]: >>> dnPrettyNormal: <"cn=Test
User+gidNumber=1000+homeDirectory=/home/test+loginShell=/bin/bash
+shadowLastChange=15337+shadowMax=99999+shadowMin=0+shadowWarning=7+uid=test
+uidNumber=1000",ou=people,dc=mydomain,dc=com>
to which OpenLDAP replies:
Feb 24 13:53:21 mydomain slapd[1912]: conn=6151 op=0 do_bind: invalid
dn ("cn=Test User+gidNumber=1000+homeDirectory=/home/test+loginShell=/
bin/bash
+shadowLastChange=15337+shadowMax=99999+shadowMin=0+shadowWarning=7+uid=test
+uidNumber=1000",ou=people,dc=mydomain,dc=com)
I'm wondering why the dn appears to use every attribute, rather than
just doing a "uid=test,dc=mydomain,dc=com"???
I know that so many people are using LDAP to authenticate with Jenkins
and am not sure where the disconnect in this specific problem is....?
I have a simple OpenLDAP install with a standard configuration. It
does seem pretty strange that the dn search that Jenkins performs
includes all attributes for the user rather than just the uid... Any
help or insight into this would be greatly appreciated! Thanks in
advance!!!
