Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-13650

Upgrading Active Directory plugin from 1.26 to 1.27 causes loss of Jenkins admin rights

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major Major
    • active-directory-plugin
    • Windows Server 2003 x86, non-domain, connecting to Windows Server 2008 Active Directory. "Domain Name" set to ourcompanyname.com, "Domain controller" left blank. Jenkins version=1.450, AD plugin version=1.26

      I just updated the AD plugin with "install without restarting" turned on to attempt to fix bug 12619 which I originally reported.

      It failed:

      INFO: Starting the installation of Active Directory plugin on behalf of tfanning
      01-May-2012 11:23:40 hudson.model.UpdateCenter$UpdateCenterConfiguration download
      INFO: Downloading Active Directory plugin
      01-May-2012 11:23:41 hudson.PluginManager dynamicLoad
      INFO: Attempting to dynamic load C:\Program Files\Jenkins\plugins\active-directory.jpi
      01-May-2012 11:23:41 hudson.model.UpdateCenter$DownloadJob run
      SEVERE: Failed to install Active Directory plugin
      hudson.util.IOException2: Failed to dynamically deploy this plugin
      at hudson.model.UpdateCenter$InstallationJob._run(UpdateCenter.java:1137)
      at hudson.model.UpdateCenter$DownloadJob.run(UpdateCenter.java:955)
      at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
      at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source)
      at java.util.concurrent.FutureTask.run(Unknown Source)
      at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
      at java.lang.Thread.run(Unknown Source)
      Caused by: java.io.IOException: Unable to delete C:\Program Files\Jenkins\plugins\active-directory\WEB-INF\lib\active-directory-1.0.jar
      at hudson.Util.deleteFile(Util.java:237)
      at hudson.Util.deleteRecursive(Util.java:287)
      at hudson.Util.deleteContentsRecursive(Util.java:198)
      at hudson.Util.deleteRecursive(Util.java:278)
      at hudson.Util.deleteContentsRecursive(Util.java:198)
      at hudson.Util.deleteRecursive(Util.java:278)
      at hudson.Util.deleteContentsRecursive(Util.java:198)
      at hudson.ClassicPluginStrategy.explode(ClassicPluginStrategy.java:389)
      at hudson.ClassicPluginStrategy.createPluginWrapper(ClassicPluginStrategy.java:113)
      at hudson.PluginManager.dynamicLoad(PluginManager.java:340)
      at hudson.model.UpdateCenter$InstallationJob._run(UpdateCenter.java:1133)
      ... 7 more

      I then restarted the Jenkins service, waited, logged in with my AD credentials, so this appeared to work.

      However in Jenkins my AD account has now lost all of its admin privileges, i.e. I nor any other person configured to have admin rights can now configure Jenkins.

      I noticed active-directory.bak left over in the Jenkins plugin folder. Stopped the service, deleted active-directory.jpi, renamed active-directory.bak to .jpi, restarted, all working (albeit with bug 12619 still present)

      How should I upgrade to 1.27 safely?

          [JENKINS-13650] Upgrading Active Directory plugin from 1.26 to 1.27 causes loss of Jenkins admin rights

          Jacob Robertson added a comment -

          More information: If I upgrade from 1.16 to 1.27 I get this error. I then change the lower.case names to Upper.Case names in config.xml and that works. Then, I went to the config screen and removed the domain name and saved, and then my Upper.Case names stopped working.

          Jacob Robertson added a comment - More information: If I upgrade from 1.16 to 1.27 I get this error. I then change the lower.case names to Upper.Case names in config.xml and that works. Then, I went to the config screen and removed the domain name and saved, and then my Upper.Case names stopped working.

          Jacob Robertson added a comment -

          Even more info...

          Depending on whether I login by typing "Jacob.Robertson" or "jacob.robertson" it will give me different permissions, but in both cases it will properly authenticate me.

          Jacob Robertson added a comment - Even more info... Depending on whether I login by typing "Jacob.Robertson" or "jacob.robertson" it will give me different permissions, but in both cases it will properly authenticate me.

          Landis Almand added a comment -

          No user rights are granted, not just loss of Admin. Only anonymous rights are granted.
          Jenkins ver. 1.447.1

          Landis Almand added a comment - No user rights are granted, not just loss of Admin. Only anonymous rights are granted. Jenkins ver. 1.447.1

          Kohsuke Kawaguchi added a comment -

          Argh. My 8b4c00a79201b605908d5d8983a7c719b0d645ff must have caused this. Fixing this now.

          Kohsuke Kawaguchi added a comment - Argh. My 8b4c00a79201b605908d5d8983a7c719b0d645ff must have caused this. Fixing this now.

          Kohsuke Kawaguchi added a comment -

          Rolled back. Fixed for 1.28.

          Kohsuke Kawaguchi added a comment - Rolled back. Fixed for 1.28.

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Kohsuke Kawaguchi
          Path:
          src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java
          http://jenkins-ci.org/commit/active-directory-plugin/15a8a87bc333a12ead447425075df3bdafd7625c
          Log:
          [FIXED JENKINS-13650] Revert "JENKINS-12607 canonicalize the name."

          This reverts commit 8b4c00a79201b605908d5d8983a7c719b0d645ff.

          Compare: https://github.com/jenkinsci/active-directory-plugin/compare/e8943e7...15a8a87

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Kohsuke Kawaguchi Path: src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java http://jenkins-ci.org/commit/active-directory-plugin/15a8a87bc333a12ead447425075df3bdafd7625c Log: [FIXED JENKINS-13650] Revert " JENKINS-12607 canonicalize the name." This reverts commit 8b4c00a79201b605908d5d8983a7c719b0d645ff. Compare: https://github.com/jenkinsci/active-directory-plugin/compare/e8943e7...15a8a87

          Kohsuke Kawaguchi added a comment -

          In 1.27, because of the 8b4c00a7 change mentioned above, Jenkins was logging users into their canonical names, like "Kohsuke Kawaguchi", instead of their user names, like "kkawaguchi". Most authorization strategies record users by their user names, so of course such change results in the permission losses.

          1.28 restores the previous behaviour. This unfortunately means for those who modified config.xml for 1.27 would have to redo that one more time. My apologies.

          Kohsuke Kawaguchi added a comment - In 1.27, because of the 8b4c00a7 change mentioned above, Jenkins was logging users into their canonical names, like "Kohsuke Kawaguchi", instead of their user names, like "kkawaguchi". Most authorization strategies record users by their user names, so of course such change results in the permission losses. 1.28 restores the previous behaviour. This unfortunately means for those who modified config.xml for 1.27 would have to redo that one more time. My apologies.

          dogfood added a comment -

          Integrated in plugins_active-directory #63
          [FIXED JENKINS-13650] Revert "JENKINS-12607 canonicalize the name." (Revision 15a8a87bc333a12ead447425075df3bdafd7625c)

          Result = SUCCESS
          Kohsuke Kawaguchi :
          Files :

          • src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java

          dogfood added a comment - Integrated in plugins_active-directory #63 [FIXED JENKINS-13650] Revert " JENKINS-12607 canonicalize the name." (Revision 15a8a87bc333a12ead447425075df3bdafd7625c) Result = SUCCESS Kohsuke Kawaguchi : Files : src/main/java/hudson/plugins/active_directory/ActiveDirectoryUnixAuthenticationProvider.java

          John Salvo added a comment -

          Confirmed that 1.28 fixed this issue.

          John Salvo added a comment - Confirmed that 1.28 fixed this issue.

          Kohsuke Kawaguchi added a comment -

          Closing based on the last comment.

          Kohsuke Kawaguchi added a comment - Closing based on the last comment.

            kohsuke Kohsuke Kawaguchi
            tomfanning Tom Fanning
            Votes:
            9 Vote for this issue
            Watchers:
            12 Start watching this issue

              Created:
              Updated:
              Resolved: