Reopened the issue in order to troubleshoot the report from orenault

> So it appears impossible to restrein the access to nested folders as we have to put at least a READ right to the root folder, then this READ right inherits to all nested folders and jobs, even the ones we don't want to give a READ right.

It is possible, but the permission regexp should be properly defined to prevent exposure of the permissions to lower levels

> So, do I have to create an issue on this point ? Or is it possible to really "give a user access to ONLY the contents of FolderA" without giving READ access to other folders ?

It is. Just write a regular expression which checks there is only one slash in the patch after the folder. Not an ideal solution, of course

I am closing it as "Not a defect" though the plugin documentation would benefit from more examples

I'm using Jenkins 2.134 with Role-based Authorization Strategy ver. 2.8.1 + Folders Plugin of ver. 6.5.1.
Structure of Jenkins projects with sub-folder structure:
Platform1/Project1/Job-1 .. Job-n
Platform2/Project2/Job-1 .. Job-n
Platform3/Project3/Job-1 .. Job-n
 
I'm struggling with granting Build/Configure access to an Active Directory group only for Platform1/Project1/Job-1 .. Job-n
without exposing read access to 
Platform2/Project2/Job-1 .. Job-n and others?
 
So that when user from AD group logs into Jenkins he see only the project he was given access to.
 
When I remove Overall read access in Global Role for group 'users' which assigned to AD - users do not see what's matched by regexp under Project Roles.
 
I'm using the following regular expressions to grant read/edit permissions:
Platform1/Project1/.*
Platform2/Project2/.***
Platform3/Project3/.***
 
Platform and Project are case sensitive.

The second comment on this issue explains what you need to do.

danielbeck, after several tries I got what I needed, thank you.

It also cost me a while to find out how to make job folders work.  Documentation should be improved.

It works nicely with: FOLDERNAME(/.*)? 

Which means: the folder name alone, and anything starting by the folder name followed a slash.

Is there a way I can give access to child folder directly without specifically giving access to Parent folder ?

I have following structure:

FolderA -> FolderB -> FolderC -> jobs

It works fine if I give specific read permissions to Folder A first, then another role for giving read access to Folder B and then another role giving read access to Folder C, which means four roles to get access to jobs.

Role 1 -> ^FolderA

Role 2 -> ^FolderA/FolderB

Role 3 -> ^FolderA/FolderB/FolderC

Role 4 -> ^FolderA/FolderB/FolderC/.*

Can the number of roles be reduced somehow by defining a pattern which can give direct access to Folder C , which internally would mean access granted to Folder A and B ?

piecing together the work of several who have grappled with this before me, i arrived at this for allowing access to something like scratch-parent/scratch-child/*

scratch-parent(/scratch-child(/.*)?)?

ankurja

I'm using such patter in your case

 ^FolderA|^FolderA/FolderB|^FolderA/FolderB|FolderC|^FolderA/FolderB/FolderC/.*

 But Tony's approach much better

 ^FolderA(/FolderB(/FolderC(/.*)?)?)?