Question

我目前正在花一些时间使用Jenkins AD-SecurityRealm（ActiveDirectorySecurityRealm）插件（v2.6）设置通用配置并遇到一个令人讨厌的问题：似乎我的方法（自动）设置有效的AD连接（遵循相应的documentation）根本不起作用。每次我重新初始化我的Jenkins实例时，都会提供一个不完整的config.xml - 总是缺少“ bindName ”属性（XML节点）。我将使用的广告服务器需要此属性，因此我必须手动覆盖配置以解决此问题。

我不知道为什么会发生这种情况。

我的常规代码（摘录）

String _domain = 'my-primary-ad-server-running.acme.org'
String _site = 'jenkins.acme.org'
String _bindName = 'ad-bind-user'
String _bindPassword = 'ad-bind-password-super-secret-123'
String _server = 'my-primary-ad-server-running.acme.org'

def hudsonActiveDirectoryRealm = new ActiveDirectorySecurityRealm(_domain, _site, _bindName, _bindPassword, _server)

def instance = Jenkins.getInstance()
    instance.setSecurityRealm(hudsonActiveDirectoryRealm)
    instance.save()

我的config.xml结果（摘录）

<securityRealm class="hudson.plugins.active_directory.ActiveDirectorySecurityRealm" plugin="active-directory@2.6">
    <domains>
      <hudson.plugins.active__directory.ActiveDirectoryDomain>
        <name>my-primary-ad-server-running.acme.org</name>
        <servers>my-primary-ad-server-running.acme.org:3268</servers>
        <bindPassword>{###-fancy-crypted-super-password-nobody-can-decrypt-anymore-###}</bindPassword>
      </hudson.plugins.active__directory.ActiveDirectoryDomain>
    </domains>
    <startTls>true</startTls>
    <groupLookupStrategy>AUTO</groupLookupStrategy>
    <removeIrrelevantGroups>false</removeIrrelevantGroups>
    <tlsConfiguration>TRUST_ALL_CERTIFICATES</tlsConfiguration>
</securityRealm>

需要我的config.xml （摘录）

<securityRealm class="hudson.plugins.active_directory.ActiveDirectorySecurityRealm" plugin="active-directory@2.6">
    <domains>
      <hudson.plugins.active__directory.ActiveDirectoryDomain>
        <name>my-primary-ad-server-running.acme.org</name>
        <servers>my-primary-ad-server-running.acme.org:3268</servers>
        <bindName>ad-bind-user</bindName>
        <bindPassword>{###-fancy-crypted-super-password-nobody-can-decrypt-anymore-###}</bindPassword>
      </hudson.plugins.active__directory.ActiveDirectoryDomain>
    </domains>
    <startTls>true</startTls>
    <groupLookupStrategy>AUTO</groupLookupStrategy>
    <removeIrrelevantGroups>false</removeIrrelevantGroups>
    <tlsConfiguration>TRUST_ALL_CERTIFICATES</tlsConfiguration>
</securityRealm>

Answer 1

感谢@kosta。以下脚本也可以在活动目录2.10和jenkins 2.150.1中使用这也包括网站信息。

import hudson.plugins.active_directory.ActiveDirectoryDomain
import hudson.plugins.active_directory.ActiveDirectorySecurityRealm
import hudson.plugins.active_directory.GroupLookupStrategy

String _domain = 'dev.test.com'
String _site = 'HQ'
String _bindName = 'dev\jenkins'
String _bindPassword = 'test'
String _server = 'dev.test.com:2328'

def hudsonActiveDirectoryRealm = new ActiveDirectorySecurityRealm(_domain, _site, _bindName, _bindPassword, _server)
hudsonActiveDirectoryRealm.getDomains().each({
    it.bindName = hudsonActiveDirectoryRealm.bindName
    it.bindPassword = hudsonActiveDirectoryRealm.bindPassword
    it.site = hudsonActiveDirectoryRealm.site
})
def instance = Jenkins.getInstance()
instance.setSecurityRealm(hudsonActiveDirectoryRealm)
instance.save()

查看以下屏幕截图：Configure Global Security

Answer 2

如果查看ActiveDirectorySecurityRealm的源代码，您会看到bindName被标记为瞬态，因此不会将其作为配置XML的一部分进行保留。

获取所需config.xml的唯一解决方案是通过提供自定义静态来强制config.xml，而不是使用init脚本。

Answer 3

我能够通过在末尾添加以下代码（在2.6和2.8上测试）来解决此问题。您还需要确保您的凭据有效，因为该插件正在执行初始连接检查https://issues.jenkins-ci.org/browse/JENKINS-48513

hudsonActiveDirectoryRealm.getDomains().each({
    it.bindName = hudsonActiveDirectoryRealm.bindName
    it.bindPassword = hudsonActiveDirectoryRealm.bindPassword
})
instance.setSecurityRealm(hudsonActiveDirectoryRealm)
instance.save()

Jenkins：使用Groovy配置ActiveDirectorySecurityRealm插件

3 个答案: