Issues Upgrading Jenkins From 2.462.3 To 2.479.2 On Windows Server

I am currently running Jenkins 2.462.3 with Java 17.0.13 on Windows Server 2022 (core mode). I utilize the LDAP module for authentication. Up until this most recent Jenkins upgrade (version 2.479.2), I’ve had no issues upgrading Plugins and Jenkins via the web interface.

After going through the upgrade thread, I read you need to update LDAP plugin first. So that is what I did below (however, I have errors now).

  1. Stopped Jenkins (Stop-Service Jenkins).
  2. Downloaded/copied ldap.hpi (version 733.vd3700c27b_043) to the following folder (renaming it to ldap.jpi):
    C:\Users\jenkins-sa\AppData\Local\Jenkins\.jenkins\plugins\
  3. Started Jenkins again (Start-Service Jenkins).

Upon visiting the page after the service start, I get the following error message. What am I doing wrong? Permissions on the file are exactly the same as the previous file (Administrators, SYSTEM, and jenkins-sa have Full Control).

com.thoughtworks.xstream.mapper.CannotResolveClassException: hudson.security.LDAPSecurityRealm
	at com.thoughtworks.xstream.mapper.DefaultMapper.realClass(DefaultMapper.java:81)
	at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
	at com.thoughtworks.xstream.mapper.DynamicProxyMapper.realClass(DynamicProxyMapper.java:55)
	at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
	at com.thoughtworks.xstream.mapper.PackageAliasingMapper.realClass(PackageAliasingMapper.java:88)
	at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
	at com.thoughtworks.xstream.mapper.ClassAliasingMapper.realClass(ClassAliasingMapper.java:79)
	at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
	at com.thoughtworks.xstream.mapper.ArrayMapper.realClass(ArrayMapper.java:74)
	at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
	at com.thoughtworks.xstream.mapper.SecurityMapper.realClass(SecurityMapper.java:71)
	at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
	at hudson.util.XStream2$CompatibilityMapper.realClass(XStream2.java:452)
	at hudson.util.xstream.MapperDelegate.realClass(MapperDelegate.java:46)
	at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:125)
	at com.thoughtworks.xstream.mapper.CachingMapper.realClass(CachingMapper.java:47)
	at hudson.util.RobustReflectionConverter.determineType(RobustReflectionConverter.java:521)
	at hudson.util.RobustReflectionConverter.doUnmarshal(RobustReflectionConverter.java:346)
Caused: jenkins.util.xstream.CriticalXStreamException: 
---- Debugging information ----
cause-exception     : com.thoughtworks.xstream.mapper.CannotResolveClassException
cause-message       : hudson.security.LDAPSecurityRealm
class               : hudson.model.Hudson
required-type       : hudson.model.Hudson
converter-type      : hudson.util.RobustReflectionConverter
path                : /hudson/securityRealm
line number         : 16
version             : 2.462.3
-------------------------------
	at hudson.util.RobustReflectionConverter.doUnmarshal(RobustReflectionConverter.java:381)
	at hudson.util.RobustReflectionConverter.unmarshal(RobustReflectionConverter.java:289)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:74)
	at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:72)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:68)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:52)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:136)
	at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)
	at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1464)
	at hudson.util.XStream2.unmarshal(XStream2.java:230)
	at hudson.util.XStream2.unmarshal(XStream2.java:201)
	at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1441)
	at hudson.XmlFile.unmarshal(XmlFile.java:196)
Caused: java.io.IOException: Unable to read C:\Users\jenkins-sa\AppData\Local\Jenkins\.jenkins\config.xml
	at hudson.XmlFile.unmarshal(XmlFile.java:199)
	at hudson.XmlFile.unmarshal(XmlFile.java:179)
	at jenkins.model.Jenkins.load(Jenkins.java:3392)
	at jenkins.model.Jenkins$12.run(Jenkins.java:3505)
	at org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:177)
	at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:305)
	at jenkins.model.Jenkins$5.runTask(Jenkins.java:1175)
	at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:221)
	at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:120)
	at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
	at java.base/java.lang.Thread.run(Thread.java:842)
Caused: org.jvnet.hudson.reactor.ReactorException
	at org.jvnet.hudson.reactor.Reactor.execute(Reactor.java:290)
	at jenkins.InitReactorRunner.run(InitReactorRunner.java:49)
	at jenkins.model.Jenkins.executeReactor(Jenkins.java:1210)
	at jenkins.model.Jenkins.<init>(Jenkins.java:997)
	at hudson.model.Hudson.<init>(Hudson.java:86)
	at hudson.model.Hudson.<init>(Hudson.java:82)
	at hudson.WebAppMain$3.run(WebAppMain.java:248)
Caused: hudson.util.HudsonFailedToLoad
	at hudson.WebAppMain$3.run(WebAppMain.java:276)

I ended up resolving my issue.

To resolve:

  1. Downloaded latest Jenkins msi file.
  2. Extracted contents of msi file.
  3. With the Jenkins service still stopped, I renamed old “C:\Program Files\Jenkins\Jenkins.war” file, then copied over new “Jenkins.war” file.
  4. Started service, and was then able to login with LDAP creds
  5. Patched remainder plugins.

Jenkins is now fully up-to-date.

Thanks very much for sharing your process to resolve the issue. The upgrade guide needs an additional step added into the LDAP plugin upgrade process. The current steps listed are:

  1. Stop the Jenkins service with systemctl stop jenkins on Linux or similar commands on other operating systems.
  2. Download the LDAP plugin from the Jenkins update center.
  3. Move ldap.hpi into $JENKINS_HOME/plugins/ldap.jpi and set the correct ownership and permissions.
  4. Start the Jenkins service with systemctl start jenkins or similar commands on other operating systems.

The step to insert after step 3 is:

  1. Upgrade Jenkins using the upgrade process appropriate for the operating system. Debian and Ubuntu users upgrade Jenkins with apt-get update && apt-get upgrade. Red Hat and derivatives upgrade with yum update. Fedora users upgrade with dnf upgrade. OpenSUSE users upgrade with zypper update. Windows users download the jenkins.war file and replace the existing jenkins.war file in their installation
  2. Start the Jenkins service with systemctl start jenkins or similar commands on other operating systems.