Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-22949

QueueItemAuthenticator fallback behavior cleanup

      Currently Queue.Item.authenticate and Tasks.getAuthenticationOf check any configured QueueItemAuthenticator instances for a specific answer, then fall back to Queue.Task.getDefaultAuthentication, which for compatibility is normally SYSTEM. This behavior makes sense if there are no configured authenticators (the default case), or if there is an authenticator which returns a non-null authentication for every task.

      The problematic case is when there is a configured authenticator yet it returns null for the given task or item. This could happen if for example ProjectQueueItemAuthenticator were configured yet a user created a new job and did not add a AuthorizeProjectProperty. Now the job runs as SYSTEM, with full privileges, whereas we would really want it to run as ANONYMOUS, with no special privileges.

      BuildTrigger and ReverseBuildTrigger already specially handle this case by substituting ANONYMOUS for SYSTEM while they run (and in the former case printing a warning to the build console). But this does not extend to other plugin or core access control checks.

      In particular, Computer.BUILD is checked in two places (on Item) when deciding whether to build a job on a particular slave. You would expect to be able to control access to sensitive slaves by selectively granting BUILD only to certain people, and then requiring them to associate themselves with jobs they wish to build on those slaves. But this scheme cannot work if they can simply omit any authentication on the job and still have the build be authorized. (Jenkins Enterprise by CloudBees has a feature using a different scheme for the same use case.)

      It would be better if the callers of QueueItemAuthenticator.authenticate fell back to getDefaultAuthentication but replaced SYSTEM with ANONYMOUS in case there were at least one authenticator consulted. Then the replacement of SYSTEM with ANONYMOUS could be removed from both BuildTrigger and ReverseBuildTrigger. BuildTrigger.warning_you_have_no_plugins_providing_ac and BuildTrigger.warning_access_control_for_builds_in_glo could be left as is, or made more generic and moved into Run.execute; BuildTrigger.warning_this_build_has_no_associated_aut should be made more generic and moved into Run.execute (and Run.running_as_ printed with anonymous).

          [JENKINS-22949] QueueItemAuthenticator fallback behavior cleanup

          Jesse Glick added a comment -

          Using the authorize-project feature does sound like the cleanest solution going forward. As alluded to in issue description, that leave a bunch of code in core that needs to be cleaned up.

          Jesse Glick added a comment - Using the authorize-project feature does sound like the cleanest solution going forward. As alluded to in issue description, that leave a bunch of code in core that needs to be cleaned up.

          Code changed in jenkins
          User: Jesse Glick
          Path:
          core/src/main/java/hudson/model/AbstractProject.java
          core/src/main/java/hudson/tasks/BuildTrigger.java
          http://jenkins-ci.org/commit/jenkins/f1a26582c1b25c470989d19b25378cff5c6d2497
          Log:
          JENKINS-28113 Allow freestyle builds to trigger downstream Pipeline builds (#2873)

          • Offering default methods on ParameterizedJob.
          • Javadoc typo.
          • Cleaner use of default methods in ParameterizedJob.
          • Sketch of pulling disabled functionality into ParameterizedJob.
          • EnableJobCommandTest.groovy → EnableJobCommandTest.java, and replacing deprecated Remoting-based CLI calls with CLICommandInvoker.
          • All CLI commands could be broken by a missing CLI.*.shortDescription key on just one!
          • Forgot to move CLI method short descriptions to new package.
          • Needed a @CLIResolver for ParameterizedJob. Adding an OptionHandler while we are here.
          • Trying to fix up access-modifier versions; started failing in CI today for unknown reasons.
          • Introduced <p:makeDisabled/> by analogy with <p:config-disableBuild/>.
          • Using new type bounds.
          • access-modifier 1.11 released.
          • MatrixProject and MavenModuleSet both expect to have access to makeDisabled.jelly.
          • Trying to generalize some more.
          • Minor simplification.
          • isBuildable
          • Obsolete comment.
          • Updated comments.
          • bridge-method-injector 1.17
          • Unfortunately AbstractProject.schedulePolling cannot delegate to SCMTriggerItem.
          • [FIXED JENKINS-28113] Generalize BuildTrigger to be able to trigger non-AbstractProject downstream ParameterizedJob’s without DependencyGraph.
          • JENKINS-22949 Dropping QueueItemAuthenticator trickiness, as in #2881.

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: core/src/main/java/hudson/model/AbstractProject.java core/src/main/java/hudson/tasks/BuildTrigger.java http://jenkins-ci.org/commit/jenkins/f1a26582c1b25c470989d19b25378cff5c6d2497 Log: JENKINS-28113 Allow freestyle builds to trigger downstream Pipeline builds (#2873) Offering default methods on ParameterizedJob. Javadoc typo. Cleaner use of default methods in ParameterizedJob. Need to pick up https://github.com/infradna/bridge-method-injector/pull/15 to be able to build. Sketch of pulling disabled functionality into ParameterizedJob. EnableJobCommandTest.groovy → EnableJobCommandTest.java, and replacing deprecated Remoting-based CLI calls with CLICommandInvoker. All CLI commands could be broken by a missing CLI.*.shortDescription key on just one! Forgot to move CLI method short descriptions to new package. Needed a @CLIResolver for ParameterizedJob. Adding an OptionHandler while we are here. Trying to fix up access-modifier versions; started failing in CI today for unknown reasons. Introduced <p:makeDisabled/> by analogy with <p:config-disableBuild/>. Using new type bounds. access-modifier 1.11 released. MatrixProject and MavenModuleSet both expect to have access to makeDisabled.jelly. Trying to generalize some more. Minor simplification. JENKINS-34716 Generalizing doPolling and schedulePolling. isBuildable Obsolete comment. Updated comments. bridge-method-injector 1.17 Unfortunately AbstractProject.schedulePolling cannot delegate to SCMTriggerItem. [FIXED JENKINS-28113] Generalize BuildTrigger to be able to trigger non-AbstractProject downstream ParameterizedJob’s without DependencyGraph. JENKINS-22949 Dropping QueueItemAuthenticator trickiness, as in #2881.

          Jesse Glick added a comment -

          in 2.61

          Jesse Glick added a comment - in 2.61

          Daniel Beck added a comment -

          jglick Should there be a changelog entry for this as well?

          Daniel Beck added a comment - jglick Should there be a changelog entry for this as well?

          Jesse Glick added a comment -

          danielbeck yes, I think I proposed some text for that in the PR, no?

          Jesse Glick added a comment - danielbeck yes, I think I proposed some text for that in the PR, no?

          Daniel Beck added a comment -

          jglick

          You wrote:

          • Freestyle projects may now list Pipeline jobs as downstream and trigger them, without needing to use the Parameterized Trigger plugin or reverse triggers.

          I used:

          Freestyle projects may now list Pipeline jobs as downstream and trigger them, without needing to use the Parameterized Trigger plugin or reverse triggers ("Build after other projects are built"). (issue 28113)

          No mention of this cleanup AFAICT.

          Daniel Beck added a comment - jglick You wrote: Freestyle projects may now list Pipeline jobs as downstream and trigger them, without needing to use the Parameterized Trigger plugin or reverse triggers. I used: Freestyle projects may now list Pipeline jobs as downstream and trigger them, without needing to use the Parameterized Trigger plugin or reverse triggers ("Build after other projects are built"). (issue 28113) No mention of this cleanup AFAICT.

          Jesse Glick added a comment -

          I think you are mixing this up with an unrelated issue.

          Jesse Glick added a comment - I think you are mixing this up with an unrelated issue.

          Daniel Beck added a comment -

          jglick The merge commit is for PR 2873. The referenced PR, 2881, is still open. The state of this issue is unclear to me.

          Daniel Beck added a comment - jglick The merge commit is for PR 2873. The referenced PR, 2881, is still open. The state of this issue is unclear to me.

          Jesse Glick added a comment -

          Sorry, this is still open.

          Jesse Glick added a comment - Sorry, this is still open.

          Code changed in jenkins
          User: Jesse Glick
          Path:
          core/src/main/java/hudson/model/Executor.java
          core/src/main/java/hudson/tasks/BuildTrigger.java
          core/src/main/java/jenkins/triggers/ReverseBuildTrigger.java
          core/src/main/resources/hudson/tasks/Messages.properties
          core/src/main/resources/hudson/tasks/Messages_bg.properties
          core/src/main/resources/hudson/tasks/Messages_de.properties
          core/src/main/resources/hudson/tasks/Messages_pt_BR.properties
          core/src/main/resources/hudson/tasks/Messages_sr.properties
          test/src/test/java/hudson/tasks/BuildTriggerTest.java
          test/src/test/java/jenkins/triggers/ReverseBuildTriggerTest.java
          http://jenkins-ci.org/commit/jenkins/915543dca5399d3ba052219ddfe9c3c061e70726
          Log:
          JENKINS-22949 BuildTrigger & ReverseBuildTrigger should respect QueueItemAuthenticatorConfiguration (#2881)

          • JENKINS-22949 Simplifying behavior of BuildTrigger & ReverseBuildTrigger to honor QueueItemAuthenticator’s as defined, rather than falling back to anonymous.
          • There is no need to impersonate what is already the current thread’s authentication.

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: core/src/main/java/hudson/model/Executor.java core/src/main/java/hudson/tasks/BuildTrigger.java core/src/main/java/jenkins/triggers/ReverseBuildTrigger.java core/src/main/resources/hudson/tasks/Messages.properties core/src/main/resources/hudson/tasks/Messages_bg.properties core/src/main/resources/hudson/tasks/Messages_de.properties core/src/main/resources/hudson/tasks/Messages_pt_BR.properties core/src/main/resources/hudson/tasks/Messages_sr.properties test/src/test/java/hudson/tasks/BuildTriggerTest.java test/src/test/java/jenkins/triggers/ReverseBuildTriggerTest.java http://jenkins-ci.org/commit/jenkins/915543dca5399d3ba052219ddfe9c3c061e70726 Log: JENKINS-22949 BuildTrigger & ReverseBuildTrigger should respect QueueItemAuthenticatorConfiguration (#2881) JENKINS-22949 Simplifying behavior of BuildTrigger & ReverseBuildTrigger to honor QueueItemAuthenticator’s as defined, rather than falling back to anonymous. There is no need to impersonate what is already the current thread’s authentication.

            jglick Jesse Glick
            jglick Jesse Glick
            Votes:
            1 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: