[FIXED JENKINS-10086] if we failed to check the account disabled flag…

…, assume it's enabled.
jenkinsci · Jun 29, 2011 · b2092a9 · b2092a9
1 parent bba459e
commit b2092a9
Showing 1 changed file with 17 additions and 2 deletions.
diff --git a/src/main/java/hudson/plugins/active_directory/ActiveDirectoryAuthenticationProvider.java b/src/main/java/hudson/plugins/active_directory/ActiveDirectoryAuthenticationProvider.java
@@ -103,13 +103,28 @@ protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticati
 
         return new ActiveDirectoryUserDetail(
             username, password,
-            !usr.accountDisabled(),
+            !isAccountDisabled(usr),
             true, true, true,
             groups.toArray(new GrantedAuthority[groups.size()])
         );
     }
 
-	protected String getDnOfUserOrGroup(String userOrGroupname) {
+    private boolean isAccountDisabled(IADsUser usr) {
+        try {
+            return usr.accountDisabled();
+        } catch (ComException e) {
+            if (e.getHRESULT()==0x8000500D)
+                /*
+                    See http://support.microsoft.com/kb/243440 and JENKINS-10086
+                    We suspect this to be caused by old directory items that do not have this value,
+                    so assume this account is enabled.
+                 */
+                return false;
+            e.printStackTrace();
+        }
+    }
+
+    protected String getDnOfUserOrGroup(String userOrGroupname) {
 		_Command cmd = ClassFactory.createCommand();
         cmd.activeConnection(con);