LDAP groups not working in Jenkins security matrix

Question

I have connected Jenkins to our LDAP server in order to manage permissions for users and groups via the security matrix. Currently it is working for individual user accounts but not for groups.

Current LDAP configuration in Jenkins finds group membership via:

* Search for groups containing user 
Group membership filter: memberOf={0}

When I add an LDAP group to the matrix, it shows the group icon next to the group-name (meaning it found the group in LDAP), but when users that are members of that group log in to Jenkins, they only have Anonymous permissions.

I have ran the groovy script given on the LDAP plugin page here: https://plugins.jenkins.io/ldap

When given a valid groupname, it will return:

"It is a GROUP: hudson.security.LDAPSecurityRealm$GroupDetailsImpl@2fb6ea7d"

I've modified the loadGroupbyGroupname line and added another line to try and get the members in a group:

    println("  It is a GROUP: " + Jenkins.instance.securityRealm.loadGroupByGroupname(name, true))
    println("  Members are : " + Jenkins.instance.securityRealm.loadGroupByGroupname(name).getMembers())

But those commands only return:

  It is a GROUP: hudson.security.LDAPSecurityRealm$GroupDetailsImpl@5f1013d0
  Members are : null

How can I get the members in the LDAP group and get these LDAP groups working in Jenkins?

Stew C Stew C · Accepted Answer · 2018-04-04T23:08:06

The group membership filter memberOf={0} was incorrect.

The Search for groups containing user option find users by querying the group. The correct value is member={0}.

If I had used the Parse user attribute for list of groups option instead, then memberOf={0} would've been correct since memberOf is the user attribute used for specifying a user's groups.

LDAP groups not working in Jenkins security matrix

1 Answers