[JENKINS-74774] Noisy log messages in active-directory-plugin after JENKINS-42687

[jenkins-infra-bot]

Note: Whereas this was mentioned in JENKINS-71170, that issue did not request a change.

The log messages introduced for the resolution of JENKINS-42687 are very noisy.  The comments above the logging calls suggest that these are not failures but they are sent at Level.WARNING and cannot be disabled via a Java option like is done with  `-Dorg.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.ADMIN_AUTO_APPROVAL_ENABLED=true`.

I can see two options off the top of my head that would help:

• downgrade to `LogLevel.FINE` (or lower)
• enable the logging to be disabled via a Java property (a la `ADMIN_AUTO_APPROVAL_ENABLED`)?   (this might be more useful, if the default behavior is to log these messages - some people might find it useful).

the two log messages are here:

https://github.com/search?q=repo%3Ajenkinsci%2Factive-directory-plugin%20JENKINS-42687&type=code

---

Originally reported by krodrigu, imported from: Noisy log messages in active-directory-plugin after JENKINS-42687

• assignee: fbelzunc
• status: Open
• priority: Minor
• component(s): active-directory-plugin
• label(s): ActiveDirectory, logging
• resolution: Unresolved
• votes: 0
• watchers: 3
• imported: 2025-12-07

Raw content of original issue

Note: Whereas this was mentioned in JENKINS-71170, that issue did not request a change.

The log messages introduced for the resolution of JENKINS-42687 are very noisy.  The comments above the logging calls suggest that these are not failures but they are sent at Level.WARNING and cannot be disabled via a Java option like is done with  `-Dorg.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.ADMIN_AUTO_APPROVAL_ENABLED=true`.

I can see two options off the top of my head that would help:

	
downgrade to `LogLevel.FINE` (or lower)
	
enable the logging to be disabled via a Java property (a la `ADMIN_AUTO_APPROVAL_ENABLED`)?   (this might be more useful, if the default behavior is to log these messages - some people might find it useful).



the two log messages are here:

https://github.com/search?q=repo%3Ajenkinsci%2Factive-directory-plugin%20JENKINS-42687&type=code

environment

Jenkins 2.462.3 (from docker image lts-jdk21)<br/>
Active Directory plugin Version2.37

[jenkins-infra-bot]

ravage:

• Original comment link
• Raw content of original comment:

  The noisiness is an issue for us, too. It's filling up the logs for no good reason.
  
  In addition to the proposed options above, I could see a configurtion setting, e.g. "Warn on partial result exceptions (see JENKINS-42687)" as a boolean flag.
  
  By the way, we are seeing this with Windows Server 2019. Thus, the comment in  JENKINS-42687 about a potential fix through a Windows Server update seems irrelevant:
  
  I had difficulties on understanding why this is happening, but according to Spring LDAP it seems that it might be a common situation on some Windows Server. Folks also said that applying a Windows Update might fix the problem.
  
  Even more so I see no point in logging this exception as-is.
  
  
    
  
      
  
        active-directory-plugin/src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java
      
      
  
          Lines 802 to 806
        in
        5598d16
      
    
    
  
      
  
  
          
  
            
  
            
   // See JENKINS-42687. Just log the exception. Sometimes all the groups are correctly 
          
  
          
  
            
  
            
   // retrieved but this Exception is launched as a last element of the NamingEnumeration 
          
  
          
  
            
  
            
   // Even if it is really a PartialResultException, I don't see why this should be a blocker 
          
  
          
  
            
  
            
   // I think a better approach is to log the Exception and continue 
          
  
          
  
            
  
            
   LOGGER.log(Level.WARNING, String.format("JENKINS-42687 Might be more members for user  %s", userDN), e); 
          
      
    
  
  
  

The noisiness is an issue for us, too. It's filling up the logs for no good reason.

In addition to the proposed options above, I could see a configurtion setting, e.g. "Warn on partial result exceptions (see JENKINS-42687)" as a boolean flag.

By the way, we are seeing this with Windows Server 2019. Thus, the comment in  JENKINS-42687 about a potential fix through a Windows Server update seems irrelevant:

I had difficulties on understanding why this is happening, but according to Spring LDAP it seems that it might be a common situation on some Windows Server. Folks also said that applying a Windows Update might fix the problem.

Even more so I see no point in logging this exception as-is.

active-directory-plugin/src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java

Lines 802 to 806 in 5598d16

	// See JENKINS-42687. Just log the exception. Sometimes all the groups are correctly
	// retrieved but this Exception is launched as a last element of the NamingEnumeration
	// Even if it is really a PartialResultException, I don't see why this should be a blocker
	// I think a better approach is to log the Exception and continue
	LOGGER.log(Level.WARNING, String.format("JENKINS-42687 Might be more members for user %s", userDN), e);

[jenkins-infra-bot]

eliasbalasis:

• Original comment link
• Raw content of original comment:

  This is probably the same problem we faced recently originating from a standard behavior of LDAP spec called referrals
  
  One part of the solution is ignoring referrals by using the "hudson.plugins.active_directory.referral.ignore=true" JVM property, not the standard "java.naming.referral=ignore" it does not work for some reason.
  
  This eliminates attempts to unnecessarily reach out to other domain controllers in the network (or failing to do so), commonly to hosts under DomainDnsZones.enterprisenet.org DNS mapping and produces a different error which is slightly less noisy but a nuisance either way.
  javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name ...
  
  To fully eliminate the noise the plugin code has to catch the javax.naming.PartialResultException and swallow it, probably using a JVM property to control the behavior.
  

This is probably the same problem we faced recently originating from a standard behavior of LDAP spec called referrals

One part of the solution is ignoring referrals by using the "hudson.plugins.active_directory.referral.ignore=true" JVM property, not the standard "java.naming.referral=ignore" it does not work for some reason.

This eliminates attempts to unnecessarily reach out to other domain controllers in the network (or failing to do so), commonly to hosts under DomainDnsZones.enterprisenet.org DNS mapping and produces a different error which is slightly less noisy but a nuisance either way.
javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name ...

To fully eliminate the noise the plugin code has to catch the javax.naming.PartialResultException and swallow it, probably using a JVM property to control the behavior.