-
Bug
-
Resolution: Duplicate
-
Major
-
None
The github-oauth-plugin does not allow one to trigger builds remotely with or without a token passed along. It instead takes the person to the Github auth page. I did install the most recent release, 0.21.2, and tried out the new "Grant ViewStatus permissions for Anonymous Users" option but no success.
- duplicates
-
-
- Resolved
-
- is related to
-
-
- Resolved
-
[JENKINS-29515] Github oauth breaks "Trigger builds remotely"
So, in the job configuration there is a place to enter a token. I just use that token. Here is a screenshot.
Sam Gleske
added a comment - This is by design in Jenkins. You would need something like the Build Authorization Token Root Plugin. I tried with the build token root plugin and still got errors.
<html><head><meta http-equiv='refresh' content='1;url=/securityRealm/commenceLogin?from=%2FbuildByToken%2Fbuild%3Fjob%3Dtest'/><script>window.location.replace('/securityRealm/commenceLogin?from=%2FbuildByToken%2Fbuild%3Fjob%3Dtest');</script></head><body style='background-color:white; color:white;'> Authentication required <!-- You are authenticated as: anonymous Groups that you are in: Permission you need to have (but didn't): hudson.model.Item.Build ... which is implied by: hudson.security.Permission.GenericUpdate ... which is implied by: hudson.security.Permission.GenericWrite ... which is implied by: hudson.model.Hudson.Administer --> </body></html>
It doesn't appear to bypass the security realm. Any thoughts jglick?
Sam Gleske
added a comment - This is by design in Jenkins. You would need something like the Build Authorization Token Root Plugin . I tried with the build token root plugin and still got errors.
<html><head><meta http-equiv= 'refresh' content= '1;url=/securityRealm/commenceLogin?from=%2FbuildByToken%2Fbuild%3Fjob%3Dtest' /><script>window.location.replace( '/securityRealm/commenceLogin?from=%2FbuildByToken%2Fbuild%3Fjob%3Dtest' );</script></head><body style= 'background-color:white; color:white;' >
Authentication required
<!--
You are authenticated as: anonymous
Groups that you are in:
Permission you need to have (but didn't): hudson.model.Item.Build
... which is implied by: hudson.security.Permission.GenericUpdate
... which is implied by: hudson.security.Permission.GenericWrite
... which is implied by: hudson.model.Hudson.Administer
-->
</body></html>
It doesn't appear to bypass the security realm. Any thoughts jglick ? elijah_lynn did this used to work for you in prior versions? If so, I have a feeling it's related to Pull Request #37. michaelneale, your thoughts on this? I doubt this ever worked but am hoping michaelneale can give some insight.
Sam Gleske
added a comment - - edited elijah_lynn did this used to work for you in prior versions? If so, I have a feeling it's related to Pull Request #37 . michaelneale , your thoughts on this? I doubt this ever worked but am hoping michaelneale can give some insight. The build token root issue seems to stem from the inability to impersonate users. The build-token-root-plugin runs a SecurityContext ACL.impersonate. Perhaps related to JENKINS-25791.
Sam Gleske
added a comment - - edited The build token root issue seems to stem from the inability to impersonate users. The build-token-root-plugin runs a SecurityContext ACL.impersonate . Perhaps related to JENKINS-25791 . Yes I was going to suggest that the token root plugin would solve this - but it appears Sam has already tried it. I know build root token plugin has worked for other identity providers.
Based on: https://issues.jenkins-ci.org/browse/JENKINS-25791 - it looks like it is not related to PR#37 - but do you want to try an older version to check? It can't hurt. Maybe some special case code is needed for this.
I don't think people come across this a lot as they tend to either a) use a github oauth token to interact with jenkins or b) use github to trigger builds directly.
If we can confirm it isn't a recent breakage perhaps should close this as a dupe of #25791 and move discussion over to there?
Thanks for the feedback Sam and Michael. I don't actually know if this worked prior. I am just coming on to this project. But we were on 0.20 and upgraded to 0.21.2 and both did not work before.
We have a temporary workaround for now, our QA automation engineer found out that we can do username:usertoken@example.com/build/job/..... But that ties our automation scripts to a username and token which would be ideal to leave out of the scripts.
What older version do you suggest trying to test?
Thanks
0.20 is before PR#37 so it's likely not ever worked. I'd recommend you just generate GitHub personal access tokens and use it to trigger builds.
It's documented in the wiki.
Sam Gleske
added a comment - - edited 0.20 is before PR#37 so it's likely not ever worked. I'd recommend you just generate GitHub personal access tokens and use it to trigger builds.
It's documented in the wiki . Sam I recommend closing this and pointing to the newrely reopened: https://issues.jenkins-ci.org/browse/JENKINS-25791
Sam Gleske
added a comment - I've closed this as a duplicate. elijah_lynn feel free to follow issue JENKINS-25791 for updates related to this. As always, contributions are welcome to help solve the issue.
Sam Gleske
added a comment - I've closed this as a duplicate. elijah_lynn feel free to follow issue JENKINS-25791 for updates related to this. As always, contributions are welcome to help solve the issue. Thanks Sam. I think there is a structural change that can probably be made to github oauth plugin to allow the root token to work at least.
sag47 the Build Authorization Token Root plugin will only help if you define a build authorization token for the project and pass it in the web request. Otherwise you are back to requiring Job/Build permission.
Even André Fiskvik
added a comment - jglick I'm able to reproduce this on jenkins-1.634-1.1 with github-oauth-plugin v 0.22.2. With "build-token-root-plugin" I have a working solution though.
Even André Fiskvik
added a comment - jglick I'm able to reproduce this on jenkins-1.634-1.1 with github-oauth-plugin v 0.22.2. With "build-token-root-plugin" I have a working solution though. 
What token are you using? A Jenkins generated token or a GitHub personal access token?
ViewedStatus option only takes effect if you have the Embeddable Build Status Plugin installed. It has nothing to do with triggering builds.