When Jenkins resolves a user, the next step in the resolution process is to determine the LDAP groups that the user belongs to. This field controls the search filter that is used to determine group membership. If left blank, the default filter will be used.
The default default filter is:
(| (member={0}) (uniqueMember={0}) (memberUid={1}))
This can be overridden by creating a file $JENKINS_HOME/LDAPBindSecurityRealm.groovy
. Irrespective
of what the default is, setting this filter to a non-blank value will determine the filter used.
You are normally safe leaving this field unchanged, however for large LDAP servers where you are seeing messages
such as OperationNotSupportedException - Function Not Implemented
,
Administrative Limit Exceeded
or similar periodically when trying to login, then that would
indicate that you should change to a more optimum filter for your LDAP server, namely one that queries only
the required field, such as:
(member={0})
Note: in this field there are two available substitutions:
{0}
- the fully qualified DN of the user{1}
- the username portion of the user