Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-18113

"user is missing Build permission" error in LTS

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Cannot Reproduce
    • Icon: Critical Critical
    • core
    • 1.509.1 running on Debian Linux with LDAP server for authentication.

      We are facing a permission issue with the current LTS version of
      jenkins. Our setup uses a single LDAP server for authentication. In one
      of our matrix jobs I have enabled specific permissions for a single LDAP
      user so that this user can administer the whole job. In the
      configuration page this user is correctly recognized from LDAP (the
      person icon is shown) and has got all permissions for that job. While
      this user can actually open the preferences page for the job, saving
      modifications to the configuration results in the error message:

      "userxxx is missing the Build permissions"

      This can be confirmed with exception messages in the log files:

      May 24, 2013 5:28:24 AM winstone.Logger logInternal
      INFO: While serving http://ourserver/view/macos/job/thejob/configSubmit: hudson.security.AccessDeniedException2: affected-user is missing the Build permission
      May 24, 2013 5:28:26 AM winstone.Logger logInternal
      SEVERE: Error while serving http://ourserver/view/macos/job/thejob/configSubmit
      java.lang.reflect.InvocationTargetException
      at sun.reflect.GeneratedMethodAccessor2202.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:288)
      at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:151)
      at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:90)
      at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:111)
      at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
      at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:241)
      at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
      at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:241)
      at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:583)
      at org.kohsuke.stapler.Stapler.service(Stapler.java:214)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:45)
      at winstone.ServletConfiguration.execute(ServletConfiguration.java:248)
      at winstone.RequestDispatcher.forward(RequestDispatcher.java:333)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:376)
      at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:95)
      at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:87)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:48)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
      at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:124)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:174)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:64)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
      at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
      at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:50)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
      at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:227)
      at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
      at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
      at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
      at java.util.concurrent.FutureTask.run(FutureTask.java:138)
      at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
      at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
      at java.lang.Thread.run(Thread.java:662)
      Caused by: java.lang.Error: This page expects a form submission
      at org.kohsuke.stapler.RequestImpl.getSubmittedForm(RequestImpl.java:768)
      at hudson.model.Job.doConfigSubmit(Job.java:1059)
      at hudson.model.AbstractProject.doConfigSubmit(AbstractProject.java:753)
      ... 69 more
      May 24, 2013 5:28:26 AM org.kohsuke.stapler.compression.CompressionFilter reportException
      WARNING: Untrapped servlet exception
      javax.servlet.ServletException: java.lang.Error: This page expects a form submission
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:719)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
      at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:241)
      at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
      at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:241)
      at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
      at org.kohsuke.stapler.Stapler.invoke(Stapler.java:583)
      at org.kohsuke.stapler.Stapler.service(Stapler.java:214)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:45)
      at winstone.ServletConfiguration.execute(ServletConfiguration.java:248)
      at winstone.RequestDispatcher.forward(RequestDispatcher.java:333)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:376)
      at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:95)
      at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:87)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:48)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
      at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:124)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

      at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:174)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:64)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
      at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66)
      at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
      at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:50)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
      at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
      at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
      at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
      at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:227)
      at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
      at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
      at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
      at java.util.concurrent.FutureTask.run(FutureTask.java:138)
      at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
      at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
      at java.lang.Thread.run(Thread.java:662)
      Caused by: java.lang.Error: This page expects a form submission
      at org.kohsuke.stapler.RequestImpl.getSubmittedForm(RequestImpl.java:768)
      at hudson.model.Job.doConfigSubmit(Job.java:1059)
      at hudson.model.AbstractProject.doConfigSubmit(AbstractProject.java:753)
      at sun.reflect.GeneratedMethodAccessor2202.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:288)
      at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:151)
      at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:90)
      at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:111)
      at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
      at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
      ... 60 more

          [JENKINS-18113] "user is missing Build permission" error in LTS

          jfigler added a comment -

          Any news on this issue? I believe we are experiencing this in 1.509.3.

          jfigler added a comment - Any news on this issue? I believe we are experiencing this in 1.509.3.

          Jeff Burke added a comment - - edited

          I'm on 1.545 on Windows 7 sp1 and get the same error. I use the Active Directory Plugin for authentication and the Role-Based Strategy Plugin for authorization. I added a project role which grants all rights. When the user logs in, indeed, the user can see all the rights are active (Delete job appears and works, "Build" or "Build with Parameters" appears, etc). For non-parameterized jobs, "Build" works. For parameterized jobs, the "Build with Parameters" link shows, but when it renders, the response is 500 in the browser... a blank page appears... and in the Jenkins System Logs, the following message appears:

          Jan 22, 2014 5:26:09 PM INFO org.eclipse.jetty.util.log.JavaUtilLog info
          While serving http://g1build008/job/SC-Dev-Deploy/build: hudson.security.AccessDeniedException2: joebob is missing the Job/Build permission
          Jan 22, 2014 5:26:09 PM WARNING org.eclipse.jetty.util.log.JavaUtilLog warn
          header full: java.lang.RuntimeException: Header>6144

          Now, I know the user has the permission Job/Build, because I can see that other jobs can be built by the user and if I remove the user from the project role, indeed, the other jobs can no longer be built by the user.

          If I set the "Global permissions" in the Role-based authentication plugin... the user can view the "Build with parameters" page and run the build.

          I don't know the details on how Jenkins manages permissions, but it would seem the global Job/Build permissions work for parameterized builds, but project-based Job/Build permissions fail.

          Jeff Burke added a comment - - edited I'm on 1.545 on Windows 7 sp1 and get the same error. I use the Active Directory Plugin for authentication and the Role-Based Strategy Plugin for authorization. I added a project role which grants all rights. When the user logs in, indeed, the user can see all the rights are active (Delete job appears and works, "Build" or "Build with Parameters" appears, etc). For non-parameterized jobs, "Build" works. For parameterized jobs, the "Build with Parameters" link shows, but when it renders, the response is 500 in the browser... a blank page appears... and in the Jenkins System Logs, the following message appears: Jan 22, 2014 5:26:09 PM INFO org.eclipse.jetty.util.log.JavaUtilLog info While serving http://g1build008/job/SC-Dev-Deploy/build: hudson.security.AccessDeniedException2: joebob is missing the Job/Build permission Jan 22, 2014 5:26:09 PM WARNING org.eclipse.jetty.util.log.JavaUtilLog warn header full: java.lang.RuntimeException: Header>6144 Now, I know the user has the permission Job/Build, because I can see that other jobs can be built by the user and if I remove the user from the project role, indeed, the other jobs can no longer be built by the user. If I set the "Global permissions" in the Role-based authentication plugin... the user can view the "Build with parameters" page and run the build. I don't know the details on how Jenkins manages permissions, but it would seem the global Job/Build permissions work for parameterized builds, but project-based Job/Build permissions fail.

          Daniel Beck added a comment -

          Does this issue still occur on recent (no older than eight weeks) versions of Jenkins? If so, please provide detailed and complete steps to reproduce the issue to aid further investigation.

          Daniel Beck added a comment - Does this issue still occur on recent (no older than eight weeks) versions of Jenkins? If so, please provide detailed and complete steps to reproduce the issue to aid further investigation.

          Johannes Wienke added a comment -

          I couldn't even remember this issue. So I suspect that this probably doesn't occur anymore, at least for us.

          Johannes Wienke added a comment - I couldn't even remember this issue. So I suspect that this probably doesn't occur anymore, at least for us.

          Daniel Beck added a comment -

          Resolving as reporter indicates this does not occur anymore.

          Please just file a new issue if a similar issue occurs in recent (no older than eight weeks) versions of Jenkins.

          Daniel Beck added a comment - Resolving as reporter indicates this does not occur anymore. Please just file a new issue if a similar issue occurs in recent (no older than eight weeks) versions of Jenkins.

            Unassigned Unassigned
            languitar Johannes Wienke
            Votes:
            5 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: