JIRA can't communicate if LDAP server signing requirements used

XMLWordPrintable

    • Type: Bug
    • Resolution: Won't Fix
    • Priority: Medium
    • None
    • Affects Version/s: 2.6.1
    • Component/s: User Management
    • None

      This problem is likely to be observed, if JIRA is integrated with Active Directory. Microsoft as part of their best practise recommendations encourage administrators to configure AD with 'LDAP server signing requirements'

      On authentication attempts against an LDAP directory using this feature the following error is reported in the log file:

      2011-02-26 22:24:14,337 http-9000-2 ERROR anonymous 1344x32x1 157zlkf 62.16.243.115,192.168.1.18 /rest/gadget/1.0/login 
      [user.provider.ldap.LDAPCredentialsProvider] Could not connect to LDAP. Please check your host 
      ('ldap://nbcdc02.nordbotten.local:389'), bind DN ('CN=Administrator,CN=Users,DC=nordbotten,DC=local') and bind password.
      javax.naming.AuthenticationNotSupportedException: [LDAP: error code 8 - 00002028: LdapErr: DSID-0C0901FC, comment: The server 
      requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v1db1
      

      Currently, our application doesn't provide any mechanism allowing us to talk with AD configured in this way. However, this problem can be worked around by:

      1. using Transport Layer Security/Secure Socket Layer (TLS/SSL) for the connection (LDAPS),
      JIRA 4.3 - http://confluence.atlassian.com/display/JIRA/Connecting+to+an+LDAP+Directory
      JIRA 4.2 - http://confluence.atlassian.com/display/JIRA042/Integrating+JIRA+with+LDAP#IntegratingJIRAwithLDAP-LDAPoverSSL
      2. reconfiguring Active Directory Group Policy Security Setting "LDAP Server Signing Requirements",
      http://support.microsoft.com/kb/823659

            Assignee:
            Unassigned
            Reporter:
            Bogdan Dziedzic [Atlassian]
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: