Jenkins integration with AD

Question

I am working on integrating a new Jenkins instance with AD. I have installed the required plugins. When I try to add a domain, it asks for info such as domain name, domain controller, etc.

I am not fully clear on the BindDN field. If I leave it blank and test the domain, it throws this warning

Leaving blank Bind DN means that any operation performed will use anonymous binding. Keep in mind that this is not recommended as some servers do not allow it by default.

I then provided a user account in BindDN which exists in the domain. Now on testing the domain, it is throwing this error log:

DC_Name:389 java.net.UnknownHostException: DC_Name at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:184) at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)

Pls share some inputs to complete the integration with AD.

Answer 1

There is information provided in theJenkins wiki page for the AD plugin , as well as some ldap tools to help diagnose.

<DOMAIN_NAME> -> Domain Name: support-cloudbees.com
<searchbase> -> Organization Unit we want to look into.
In the example, it is OU=Support, DC=support-cloudbees, DC=com
<binddn> -> Bind DN.
In the example, CN=felix, OU=Support, DC=support-cloudbees, DC=com
<passwd> -> Bind Password
<userid> -> User we want to look for. We can look for the managerDN itself or for a different user on the tree.
In the example, this can be set-up for example to CN=felix, OU=Support, DC=support-cloudbees, DC=com .

As described here ,

The Bind DN is comprised of the user and the location of the user in the LDAP directory tree . Each element of the Distinguished Name is pointed out : The first part is the user CN=user1. The second part is the container CN=Users. The third part is the domain DC=example and DC=com

Did you correctly specify "the location of the user in the LDAP tree"? The error appears to be with a DC value.

Ours is in the form:
cn=<Acct Name>, ou=<some_value>, ou=<some_value>, dc=<some_value>, dc=<some_value>

YMMV. Try use the ldap tools mentioned to validate.