Skip to content

Latest commit

 

History

History
100 lines (84 loc) · 4.73 KB

README.md

File metadata and controls

100 lines (84 loc) · 4.73 KB
Raw

Authorize Project Plugin for Jenkins

This plugin allows projects to run builds with specified authorization.

What's this?

This plugin provides following features:

  • You can configure projects to have their builds run with specified authorization.
  • Provides following ways to specify authorization.
    • Run as the user who triggered the build.
      • Does not work for scheduled, or polled builds.
      • Configuring projects are allowed only to users with the BUILD permission.
    • Run as anonymous.
    • Run as the specified user.
      • You are requested to enter the password of the specified user except in the following cases:
        • You are an administrator.
        • You are the specified user.
        • The specified user is not changed from the last configuration, and "No need for re-authentication" is checked.
          • This can be a security risk
      • Configuring projects are allowed only to administrators and the user configured as the authorization.
        • "Don't restrict job configuration" allows other users (with the CONFIGURE permission) to configure the project. Ensure that only appropriate users have CONFIGURE permission for that project.
    • Run as SYSTEM
      • This is provided only to cancel the global configuration. SYSTEM authorization is often considered as "unconfigured", features provided by plugins may treat it as anonymous.
  • Provides an extension point to add new ways to specify authorization.

Screenshots

  • The plugin adds "Access Control for Builds" in "Manage Jenkins" > "Configure Global Security". Adding "Configure Build Authorizations in Project Configuration" enables Authorize Project plugin.
    • You can also disable specific strategies in this page. Disabled strategies are never used for authorization.
  • A new side bar menu "Authorization" will appear in project pages.
  • You can select how to authorize builds of the project in the "Authorization" page.
  • When selecting "Run as Specific User", you can enter User ID with whose authorization builds will run. If you enter a user ID except yourself and have no administrative privilege, you are required to enter the password of that user.
    • You can also use API token, especially for non password-based security realms.
  • Configuring project settings by unauthorized users are forbidden when you configure the authorization for the project. See What's this? for details.

Extension point

A new way to authorize projects can be added by extending AuthorizeProjectStrategy, overriding the following method:

public abstract Authentication authenticate(
    hudson.model.AbstractProject<?, ?> project,
    hudson.model.Queue.Item item
);

Use AuthorizeProjectStrategyDescriptor for Descriptor. If you want to provide global configuration properties, do as following:

  • global-security.jelly is displayed in "Configure Global Security" page.
  • Override AuthorizeProjectStrategyDescriptor#configureFromGlobalSecurity to save configuration.

Issues

To report a bug or request an enhancement to this plugin please create a ticket in JIRA (you need to login or to sign up for an account). Also have a look on How to report an issue

Change Log