Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-17200

SCM.TAG permission not eagerly loaded

XMLWordPrintable

      In order to be included in Permission.getAll(), a Permission needs to be initialized in a static block inside an @Extension or otherwise definitely loaded during startup.

      The visible symptom is that you might configure an authorization strategy such as matrix with all permissions granted, then go back later and see SCM/Tag missing, because it was unknown earlier.

          [JENKINS-17200] SCM.TAG permission not eagerly loaded

          Jesse Glick created issue -

          Jesse Glick added a comment -

          Would be better to have some kind of declarative registration for permissions. Could handle default grant status for things like JENKINS-15484 as well. Some other messiness: hudson.security.WipeOutPermission=true; hudson.security.ArtifactsPermission=true; and of course https://wiki.jenkins-ci.org/display/JENKINS/Extended+Read+Permission+Plugin is well known.

          https://github.com/jenkinsci/embeddable-build-status-plugin/pull/4/files#r4421926 claims that at least for Project-based Matrix Authorization Strategy even loading the permission in an @Extension does not suffice—perhaps because it tries to load the matrix before extensions are loaded?

          Jesse Glick added a comment - Would be better to have some kind of declarative registration for permissions. Could handle default grant status for things like JENKINS-15484 as well. Some other messiness: hudson.security.WipeOutPermission=true ; hudson.security.ArtifactsPermission=true ; and of course https://wiki.jenkins-ci.org/display/JENKINS/Extended+Read+Permission+Plugin is well known. https://github.com/jenkinsci/embeddable-build-status-plugin/pull/4/files#r4421926 claims that at least for Project-based Matrix Authorization Strategy even loading the permission in an @Extension does not suffice—perhaps because it tries to load the matrix before extensions are loaded?
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-15484 [ JENKINS-15484 ]
          Jesse Glick made changes -
          Labels Original: permissions New: api permissions

          Jesse Glick added a comment -

          Blocking JENKINS-16502, perhaps.

          Jesse Glick added a comment - Blocking JENKINS-16502 , perhaps.
          Jesse Glick made changes -
          Link New: This issue is blocking JENKINS-16502 [ JENKINS-16502 ]
          Jesse Glick made changes -
          Link New: This issue is related to SECURITY-91 [ SECURITY-91 ]
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-27134 [ JENKINS-27134 ]
          Jesse Glick made changes -
          Labels Original: api permissions New: 2.0 api permissions
          Daniel Beck made changes -
          Labels Original: 2.0 api permissions New: 2.0-rejected api permissions

            Unassigned Unassigned
            jglick Jesse Glick
            Votes:
            2 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated: