Delimiter between domain and username in jenkins user is sometimes \, sometimes _ Why?

Question

I'm seeing some odd things with jenkins and sending mail. For some users mail is sent to DOMAIN_username@company.com - some are fine.

Jenkins is using AD for authentication - most users haven't actually logged into jenkins, the username comes from svn. my svn server is a windows2008 server using sspi to authenticate:

# authentication
AuthName "Subversion Authentication"
AuthType SSPI
SSPIAuth On
SSPIAuthoritative On
SSPIDomain COMPANY
SSPIOfferBasic On
Require valid-user

the best place to see it is in the http://jenkins/job/job-name/1234/api/json and look at culprits

"culprits":[
{"absoluteUrl":"http://jenkins/user/DOMAIN_asmith","fullName":"DOMAIN_asmith"},
{"absoluteUrl":"http://jenkins/user/DOMAIN_bobama","fullName":"DOMAIN\\bobama"}
]

Things are goign to work fine for bobama, but note asmith - the email will go to DOMAIN_asmith@company.com (which won't deliver)

If I look at the users configuration page http://jenkins/user/DOMAIN_asmith/configure

I see his email is actually listed as DOMAIN_asmith@company.com, bobama looks fine.

These values aren't coming from the user (neither has ever logged in to jenkins) - they're coming from AD by way of SVN. I'm stuck - anyone point me in a better direction?

What is the asmith's fullname and e-mail address in AD account details? — bahrep, Aug 02 '12 at 09:11
Do you have two AD servers running on the same domain? One could be older and reporting slightly different information. We had a version of this problem when we were installing Google Apps with AD Password Syncing (it depended on which server a user authenticated against) — Jason Sperske, Aug 07 '12 at 18:13
Also if a field is empty in AD, then Jenkins (or mod_ldap) could be populating it with a best guess — Jason Sperske, Aug 07 '12 at 18:15
Opps. terribly bad form to put a bounty and then go on vacation - thought I'd have better net access. will answer questions and put a bigger bounty up. — thekbb, Aug 09 '12 at 16:08
@bahrep I got JXplorer and have been poking around in AD... things look the same asmith has displayName: Adam Smith mail: asmith@company.com mailNickname: asmith bobama has: display name: Barack Obama mail: boboma@company.com mailNickname: bobama this is pretty far outside my area of expertise — thekbb, Aug 09 '12 at 19:06

djf · Accepted Answer · 2012-08-15T18:40:53.707

Here are a couple of Ideas:

If you change to the directory where asmith was the last committer and you do svn info . What does the LastChanged Author say? "DOMAIN\asmith" or something else? What does it say for bobama?
If the information going into Jenkins is really identical for all users, then the difference has to be inside Jenkins. I've been looking at the source of MailAddressResolver, which is just a dispatching class that invokes other resolvers. However, I'm not sure which one is invoked in your configuration. There are fallback scenarios which try to guess the correct email if none of the resolvers succeeds. One that looks very interesting is 'MailAddressResolver problems with SVN & SSPI authentication'. This should actually replace 'DOMAIN_user@company.com' with 'DOMAIN\user@company.com'
I've noticed logging in Jenkins' source. If the logs don't already indicate problems during the mail address resolution, you could add more loggers in the web interface.
While going through the bug reports, I noticed 'E-mail to individuals who broke the build is sent to wrong address'. Which sounds a lot like the problem you're experiencing. And it's unresolved.

Possible Workaround

While searching in all directions at once I discovered the RegEx Email Plugin. It allows you to generate user email addresses from usernames using regular expressions. Maybe you could twist Jenkins' arm with this to get the mail format you need.

That was most excellent advice - I added a logger and understand what's going on. I must admit i used the regex email plugin to fix up the mails. — thekbb, Aug 16 '12 at 16:34

score 1 · Answer 2 · answered Dec 17 '12 at 09:04

1

I've created Additional Identities plugin for this purpose. Only a workaround until I found a better solution, but can help.

answered Dec 17 '12 at 09:04

nicolas de loof

2,593
1
13
11

score 0 · Answer 3 · answered Aug 09 '12 at 20:14

I'm thinking more and more that this is svn/sspi releated

I'd like to install svn on linux and not deal with windows at all... I think I can add 'SSPIOmitDomain On' to my conf file and then not have the domain at all, but this is sub-optimal as I'd have then want to dump all the repositories to make the usernames match.

Delimiter between domain and username in jenkins user is sometimes \, sometimes _ Why?

3 Answers3

Possible Workaround