Jenkins 2.102 AD安全域连接缓慢及首次登录延迟问题排查

Hey there, let's break down your two Jenkins Active Directory issues and walk through practical fixes— I’ve debugged similar AD integration slowdowns before, so here’s what works:

First, let's tackle the missing logs and then the slow test connection:

• Fixing empty Jenkins logs: The default log level doesn’t capture detailed AD plugin activity. To get useful logs without flooding the file:
  1. Go to Manage Jenkins > System Log > Log Levels
  2. Add a new logger with the name hudson.plugins.active_directory and set its level to FINE (avoid FINEST— it’ll generate way too much noise)
  3. Double-check permissions on /var/log/jenkins/jenkins.log with ls -l /var/log/jenkins/jenkins.log— make sure the jenkins user owns it. If not, run chown jenkins:jenkins /var/log/jenkins/jenkins.log to fix write access.
• Speeding up "Test Domain": Slow test responses usually stem from network/DNS issues or auto-discovering too many domain controllers. Try these:
  1. Test AD connectivity manually with ldapsearch to rule out network delays:

     ldapsearch -x -H ldap://your-ad-server:389 -b "DC=yourdomain,DC=com" -D "CN=your-jenkins-service-account,DC=yourdomain,DC=com" -W
     

     If this command takes time, you’ve got a network/DNS problem to fix first.
  2. In your AD security domain config, stop Jenkins from auto-discovering DCs— specify a single, nearby domain controller explicitly. Auto-discovery often scans multiple DCs, causing delays.

Your log tells the story: the LDAP_MATCHING_RULE_IN_CHAIN group lookup is taking 30+ seconds, and the plugin switches to recursive lookup after the first fail. Here’s how to skip that slow initial query:

• Force recursive group lookup upfront: In your AD security domain’s Advanced settings, check the box for Use recursive group lookup. This makes the plugin use the faster recursive method from the start, instead of trying the slow MATCHING_RULE_IN_CHAIN first.
• Enable user/group caching: Go to Manage Jenkins > Configure Global Security and set up a user cache (e.g., 1-hour expiration). This stores user and group data locally after the first login, so subsequent logins (even after restarts, once the cache is populated) will be instant.
• Optimize AD group structure: If you have deeply nested groups, even recursive lookups can lag. Simplify group nesting where possible, and ensure your Jenkins service account has the necessary permissions to query groups quickly in AD.

内容的提问来源于stack exchange，提问作者Kaliyug Antagonist