When Jenkins is asked to determine if a named group exists, it uses a default filter of:
(& (cn={0}) (| (objectclass=groupOfNames) (objectclass=groupOfUniqueNames) (objectclass=posixGroup)))
relative to the Group search base
to determine if there is a group with the specified name (
{0}
is substituted by the name being searched for)
If you know your LDAP server only stores group information in one specific object class, then you can improve
group search performance by restricting the filter to just the required objectclass
.
Note: if you are using the LDAP security realm to connect to Active Directory (as opposed to using the Active Directory plugin's security realm) then you will need to change this filter to:
(& (cn={0}) (objectclass=group) )
Note: if you leave this empty, the default search filter will be used, unless the
hudson.security.LDAPSecurityRealm.groupSearch
has been set to modify the default.