Jenkins Integration with FreeIPA LDAP

[Yogesh Sharma]

Hi List,

I am trying to integrate Jenkins with FreeIPA LDAP. Configuration is done and seems to be OK as there is no error. However, I am not able to authenticate into the Jenkins using FreeIPA LDAP users.

Jenkins logs does not say anything. Tried adding Log Level:

org.acegisecurity.providers.ldap.authenticator,org.acegisecurity.providers.ldap.LdapAuthenticationProvider (WARNING) but does not help.

Below is LDAP Config in Jenkins:

	root DN
		Allow blank rootDN
	User search base
	User search filter
		Case sensitivity...
	Group search base
	Group search filter
	Group membership	Parse user attribute for list of groups  Search for groups containing user   Group membership filter
	Manager DN
	Manager Password
	Display Name LDAP attribute
	Email Address LDAP attribute
		Disable Ldap Email Resolver
Enable cache
	Environment Properties	Add
Login with Google
PWauth Authentication
Unix user/group database

[Neil White]

I'm running Jenkins 2.21 and I got it running on LDAP with only the following details.

This is from the config.xml, which you can translate into the frontend.

<server>ipa.example.com</server>

<rootDN>dc=example,dc=com</rootDN>

<inhibitInferRootDN>false</inhibitInferRootDN>

<userSearchBase>cn=users,cn=accounts</userSearchBase>

<userSearch>uid={0}</userSearch>

<groupSearchBase>cn=groups,cn=accounts</groupSearchBase>

<groupSearchFilter>memberOf=cn=jenkins,cn=groups,cn=accounts,dc=example,dc=com</groupSearchFilter>

<groupMembershipStrategy class="jenkins.security.plugins.ldap.FromGroupSearchLDAPGroupMembershipStrategy">

  <filter></filter>

</groupMembershipStrategy>

<managerDN>uid=jenkins,cn=sysaccounts,cn=etc,dc=example,dc=com</managerDN>

<managerPasswordSecret>TRLkkCtAA1X2hAyqXXXXXXXXXXXXXXXXXXXOsJz8Q3txUCTprcl/qTItIFNDrR5x7</managerPasswordSecret>

<disableMailAddressResolver>false</disableMailAddressResolver>

<displayNameAttributeName>displayname</displayNameAttributeName>

<mailAddressAttributeName>mail</mailAddressAttributeName>

<userIdStrategy class="jenkins.model.IdStrategy$CaseInsensitive"/>

<groupIdStrategy class="jenkins.model.IdStrategy$CaseInsensitive"/>

</securityRealm>

[Michael Lasevich]

Out of curiosity, have you gotten the groups to work in this config?

I have this same setup working, but I can only see groups IFF the user already has admin rights  (which is very backwards and useless, as groups are mostly meaningless if you are already admin). I opened a bug with LDAP plugin (https://issues.jenkins-ci.org/browse/JENKINS-37858)

-M