[JIRA] (JENKINS-38124) Although FromUserRecordLDAPGroupMembershipStrategy is configured, Jenkins still populates authorities by using group search (with the default pattern)

[martin.san...@sap.com (JIRA)]

Title: Message Title

Martin Sander created an issue   Jenkins / JENKINS-38124 Although FromUserRecordLDAPGroupMembershipStrategy is configured, Jenkins still populates authorities by using group search (with the default pattern) Issue Type: Bug Assignee: Kohsuke Kawaguchi Components: ldap-plugin Created: 2016/Sep/12 7:48 AM Priority: Minor Reporter: Martin Sander To reproduce: configure Jenkins with LDAP security check "Group membership: Parse user attribute for list of groups" this will lead to the following entry in config.xml: <groupMembershipStrategy class="jenkins.security.plugins.ldap.FromUserRecordLDAPGroupMembershipStrategy"/> configure full logging for the org.acegisecurity package (all log levels) log in with an arbitrary (probably best new) user, let's call him HORST check the logs, you will see something like this: Searching for roles for user 'HORST', DN = 'cn=HORST,ou=KEVIN,ou=GUENTHER,dc=big,dc=expensivie,dc=corporation,dc=com', with filter (| (member={0}) (uniqueMember={0}) (memberUid={1})) in search base 'OU=KEVIN,OU=GUENTHER' I.e. Jenkins is using the potentially very expensive default group filter on login, although the user configured to use memberOf instead. The reason for this is this call here https://github.com/jenkinsci/ldap-plugin/blob/master/src/main/java/hudson/security/LDAPSecurityRealm.java#L1010: super.getGroupMembershipRoles(userDn,username) Which in turn uses the configured groupSearchFilter in org.acegisecurity.providers.ldap.populator.DefaultLdapAuthoritiesPopulator. This should probably instead call the code in FromUserRecordLDAPGroupMembershipStrategy.getGrantedAuthorities, like it is called here. I would have created a pull request, but it is a bit beyond me how to access groupMembershipStrategy from AuthoritiesPopulatorImpl. Add Comment   This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.