Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-15484

New permission controlling ability to configure your own User

XMLWordPrintable

      An administrator may want to block access to /me/configure, for example to prevent users from changing their own display names.

      Currently this appears to be impossible, as User.doConfigSubmit calls User.checkPermission, not Jenkins.checkPermission, and User.getACL is implemented to give every user permission to configure himself, regardless of authorization strategy.

      User.doConfigSubmit should additionally check some newly introduced global permission (such as User.SELF_CONFIGURE) which would be on by default for all (authenticated) users but could be explicitly disabled.

      The tricky part is introducing such a permission and granting it by default, since new permissions are rejected by default, and this one should not be implied by any existing permission.

          [JENKINS-15484] New permission controlling ability to configure your own User

          Jesse Glick created issue -
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-17200 [ JENKINS-17200 ]
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-21336 [ JENKINS-21336 ]
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 146240 ] New: JNJira + In-Review [ 176562 ]
          Daniel Beck made changes -
          Labels Original: configuration permissions security user New: configuration new-permission permissions security user
          Jesse Glick made changes -
          Link New: This issue relates to JENKINS-16502 [ JENKINS-16502 ]

            jglick Jesse Glick
            jglick Jesse Glick
            Votes:
            1 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated: