Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-35310

ComputedFolder shows BuildAuthorizationToken configuration but does not actually support it

    XMLWordPrintable

    Details

    • Similar Issues:

      Description

      Trying to use the "Trigger builds remotely (e.g., from scripts)" Build Trigger from a multibranch pipeline project doesn't seem to work.

      If I check off the box and type in a token and click save, the job saves successfully but it does not write an authToken element to the job config and the item is unchecked in the configuration when I reload the page. Even manually setting an authToken and POSTing the config doesn't work. While the element is there in the config, I'm not able to kick a job off with the token.

      I can post some screenshots and config snippets if that will be helpful, but this seems to be reproducible easily enough that it might be overkill.

      I've been able to reproduce this with a fresh Jenkins 2.x install as well.

      Repro case

      Given: A Jenkins 1.651.2 instance with some kind of security enabled (e.g. anonymous users cannot build jobs). And the pipeline plugins installed.

      1. Create a freestyle or single pipeline job.
      2. Under "Build Triggers," select "Trigger builds remotely (e.g., from scripts)"
      3. Enter "hello" in the "Authentication Token" field
      4. Save the job.
      5. POST to jobUrl/build?token=hello (e.g. curl -XPOST http://172.17.0.2:8080/job/freestyle/build?token=hello)
      6. Observe the job is triggered.
      7. Create a multibranch pipeline job.
      8. Add an authentication token as above.
      9. Save the job.
      10. POST to jobUrl/build?token=hello (e.g. curl -XPOST http://172.17.0.2:8080/job/multibranch/build?token=hello)
      11. Observe you receive an "Authentication required" error.
      12. Go back to the job configuration and observe the Build Trigger isn't enabled.

        Attachments

          Issue Links

            Activity

            nmaclennan Norm MacLennan created issue -
            recena Manuel Recena Soto made changes -
            Field Original Value New Value
            Assignee Manuel Recena Soto [ recena ] Jesse Glick [ jglick ]
            Hide
            jglick Jesse Glick added a comment -

            Add an authentication token as above. Save the job.

            Can you be more specific? This is currently impossible: there is no “trigger builds remotely” option on the multibranch folder; and the branch projects are read-only so they have no Save button.

            As noted in JENKINS-30519, it could be made possible somehow.

            Show
            jglick Jesse Glick added a comment - Add an authentication token as above. Save the job. Can you be more specific? This is currently impossible: there is no “trigger builds remotely” option on the multibranch folder; and the branch projects are read-only so they have no Save button. As noted in JENKINS-30519 , it could be made possible somehow.
            jglick Jesse Glick made changes -
            Link This issue is related to JENKINS-30519 [ JENKINS-30519 ]
            nmaclennan Norm MacLennan made changes -
            Attachment config-screen.png [ 32915 ]
            Hide
            nmaclennan Norm MacLennan added a comment -

            Hi Jesse Glick,

            I do see the option in my multibranch folder (or maybe we're talking about different things).

            I'm doing this in a docker container, so I don't (or shouldn't) have any other plugins or weird configuration messing things up.

            I ran: docker run -it --rm jenkins:2.3. Then I went through the set-up flow, installed recommended plugins, and created an admin user. I clicked "New Item" and chose to make a MutliBranch Pipeline. The config screen looks like the below. If I fill in that box and click save, the setting doesn't get put into the job config.

            This happens for regular (non-multibranch) pipeline projects as well. The same thing also happens in latest jenkins 1.x image, but it is a lengthier repro case.

            Show
            nmaclennan Norm MacLennan added a comment - Hi Jesse Glick , I do see the option in my multibranch folder (or maybe we're talking about different things). I'm doing this in a docker container, so I don't (or shouldn't) have any other plugins or weird configuration messing things up. I ran: docker run -it --rm jenkins:2.3 . Then I went through the set-up flow, installed recommended plugins, and created an admin user. I clicked "New Item" and chose to make a MutliBranch Pipeline. The config screen looks like the below. If I fill in that box and click save, the setting doesn't get put into the job config. This happens for regular (non-multibranch) pipeline projects as well. The same thing also happens in latest jenkins 1.x image, but it is a lengthier repro case.
            Hide
            wstrange Warren Strange added a comment -

            I am seeing the same issue with multi-branch pipeline

            The "Trigger builds remotely" will not save the Authentication token. You can enter it - but it never gets saved

            Show
            wstrange Warren Strange added a comment - I am seeing the same issue with multi-branch pipeline The "Trigger builds remotely" will not save the Authentication token. You can enter it - but it never gets saved
            Hide
            swimfrog Ben Hawkins added a comment -

            I am also experiencing this issue.

            Show
            swimfrog Ben Hawkins added a comment - I am also experiencing this issue.
            Hide
            lpovlsen Lars Povlsen added a comment - - edited

            Jesse, I'm also seeing this. I think the confusion is between the top-level project "Configure" and the branch object "View Configuration".

            Btw, if anyone has a workaround for this I'ld be happy to hear about it. (I'm using periodic build atm, which just doesn't scale well....).

            I'm on 2.7 for the record.

            Show
            lpovlsen Lars Povlsen added a comment - - edited Jesse, I'm also seeing this. I think the confusion is between the top-level project "Configure" and the branch object "View Configuration". Btw, if anyone has a workaround for this I'ld be happy to hear about it. (I'm using periodic build atm, which just doesn't scale well....). I'm on 2.7 for the record.
            Hide
            akaias Axel Kämpfe added a comment -

            Hey, i can confirm this also on the latest versions of Jenkins (2.8) and with up-to-date plugins list.

            i have created a fresh multibranch-pipeline (MBP) project where i want to call depending, also MBP projects to be build after each other.
            unfortunately, in the "main" project config ( not in the branch specific ) it is not possible to save the option "Trigger builds remotely"

            Show
            akaias Axel Kämpfe added a comment - Hey, i can confirm this also on the latest versions of Jenkins (2.8) and with up-to-date plugins list. i have created a fresh multibranch-pipeline (MBP) project where i want to call depending, also MBP projects to be build after each other. unfortunately, in the "main" project config ( not in the branch specific ) it is not possible to save the option "Trigger builds remotely"
            Hide
            sucklead Nick Heap added a comment -

            Also seeing this in my Multibranch Pipeline job on 2.10.

            Show
            sucklead Nick Heap added a comment - Also seeing this in my Multibranch Pipeline job on 2.10.
            Hide
            pj_parra Pierre-Jean Parra added a comment -

            I also have this problem in a Multibranch Pipeline job on 2.11

            Show
            pj_parra Pierre-Jean Parra added a comment - I also have this problem in a Multibranch Pipeline job on 2.11
            Hide
            svenbrnn Sven Brunner added a comment -

            We also got this problem. It would be very nice to see this resolved soon since we need this feature for our projekts.

            Show
            svenbrnn Sven Brunner added a comment - We also got this problem. It would be very nice to see this resolved soon since we need this feature for our projekts.
            Hide
            tinod Tino Decker added a comment -

            We are also seeing this in our Multibranch Pipeline and it's a real blocker. Is there any progress on this?

            Show
            tinod Tino Decker added a comment - We are also seeing this in our Multibranch Pipeline and it's a real blocker. Is there any progress on this?
            plehmkuhl Phil Lehmkuhl made changes -
            Rank Ranked higher
            Hide
            zakki Kensuke Matsuzaki added a comment -

            As a workaround, I created a simple project 'multibranch-project-trigger' that receive build trigger events,
            and run indexer by calling
            "curl -X POST -u me:xxxxxxxxxx http://jenkins/job/multibranch-project/build?delay=0"

            Show
            zakki Kensuke Matsuzaki added a comment - As a workaround, I created a simple project 'multibranch-project-trigger' that receive build trigger events, and run indexer by calling "curl -X POST -u me:xxxxxxxxxx http://jenkins/job/multibranch-project/build?delay=0 "
            rtyler R. Tyler Croy made changes -
            Workflow JNJira [ 171557 ] JNJira + In-Review [ 184357 ]
            Hide
            mickaelperrin Mickaël Perrin added a comment -

            Can confirm the issue, really annoying.

            Show
            mickaelperrin Mickaël Perrin added a comment - Can confirm the issue, really annoying.
            Hide
            kokx Pieter Kokx added a comment -

            This is a problem for us as well. Because of this issue, there is no good way to trigger creation of new jobs for new pull requests, other than with active polling.

            Show
            kokx Pieter Kokx added a comment - This is a problem for us as well. Because of this issue, there is no good way to trigger creation of new jobs for new pull requests, other than with active polling.
            jglick Jesse Glick made changes -
            Component/s workflow-multibranch-plugin [ 21465 ]
            Hide
            stefanthurnherr Stefan Thurnherr added a comment - - edited

            Also confirming this issue, running Jenkins 2.18 with all plugins up-to-date.

            My usecase: Trying to use this to trigger builds upon push events in GitLab Community Edition, since the "Gitlab Hook Plugin" doesnt seem to work anyway for multi-branch projects, and anyway seems to be deprecated in favour of the "GitLab plugin" (but only available in GitLab EE).

            A possible workaround could be what is described in the first comment of JENKINS-33295: Basically having a simple freestyle job that gets the build triggers and then starts the job from the multi-branch project that corresponds to the changed branch. But I dont have EnvInject installed (yet), so havent had the chance to try it.

            Show
            stefanthurnherr Stefan Thurnherr added a comment - - edited Also confirming this issue, running Jenkins 2.18 with all plugins up-to-date. My usecase: Trying to use this to trigger builds upon push events in GitLab Community Edition, since the "Gitlab Hook Plugin" doesnt seem to work anyway for multi-branch projects, and anyway seems to be deprecated in favour of the "GitLab plugin" (but only available in GitLab EE). A possible workaround could be what is described in the first comment of JENKINS-33295 : Basically having a simple freestyle job that gets the build triggers and then starts the job from the multi-branch project that corresponds to the changed branch. But I dont have EnvInject installed (yet), so havent had the chance to try it.
            abayer Andrew Bayer made changes -
            Component/s pipeline-general [ 21692 ]
            abayer Andrew Bayer made changes -
            Component/s workflow-plugin [ 18820 ]
            jglick Jesse Glick made changes -
            Link This issue duplicates JENKINS-33020 [ JENKINS-33020 ]
            jglick Jesse Glick made changes -
            Resolution Duplicate [ 3 ]
            Status Open [ 1 ] Resolved [ 5 ]
            Hide
            jglick Jesse Glick added a comment -

            Finally see what everyone is talking about—an option on the multibranch folder, not the actual jobs (branch projects). This was never intended to even be presented; ComputedFolder/configure-details.jelly should not use <p:config-trigger/>.

            To initiate branch indexing from a script, you must use the build REST API with an authentication token.

            Show
            jglick Jesse Glick added a comment - Finally see what everyone is talking about—an option on the multibranch folder, not the actual jobs (branch projects). This was never intended to even be presented; ComputedFolder/configure-details.jelly should not use <p:config-trigger/> . To initiate branch indexing from a script, you must use the build REST API with an authentication token.
            jglick Jesse Glick made changes -
            Component/s cloudbees-folder-plugin [ 18137 ]
            Component/s pipeline [ 21692 ]
            Labels multibranch pipeline
            Summary "Trigger builds remotely" doesn't save authToken ComputedFolder shows BuildAuthorizationToken configuration but does not actually support it
            Hide
            jglick Jesse Glick added a comment -

            trigger builds upon push events

            This should be done with the webhook for the Git plugin, /git/notifyCommit.

            Show
            jglick Jesse Glick added a comment - trigger builds upon push events This should be done with the webhook for the Git plugin, /git/notifyCommit .
            Hide
            kokx Pieter Kokx added a comment -

            Jesse Glick
            > To initiate branch indexing from a script, you must use the build REST API with an authentication token.

            Which is exactly what we are trying to do. The build REST API however, only exposes this for the actual jobs (the /job/<project>/<job>/build endpoint). So either there is some endpoint we cannot find (some missing documentation I guess?). Or some configuration for an auth token that is missing. Or something else.

            Most of us that are here, are here because we couldn't get it to work.

            > This should be done with the webhook for the Git plugin, /git/notifyCommit.

            Which only works if you use the Git plugin. However, since we kinda need GitHub build status notifications for commits, we use that instead. Neither could I find an alternative for this webhook when using the GitHub plugin.

            Also, if we use some magic and trigger builds directly on the actual jobs themselves, this will have the side-effect that doing a re-index will also trigger a new build on the same job. Which means you have a lot of useless double builds clogging your build servers.

            For now, we are forced to use active polling, and poll GitHub for changes every 2 minutes. However, we really prefer not to have to do that.

            Show
            kokx Pieter Kokx added a comment - Jesse Glick > To initiate branch indexing from a script, you must use the build REST API with an authentication token. Which is exactly what we are trying to do. The build REST API however, only exposes this for the actual jobs (the /job/<project>/<job>/build endpoint). So either there is some endpoint we cannot find (some missing documentation I guess?). Or some configuration for an auth token that is missing. Or something else. Most of us that are here, are here because we couldn't get it to work. > This should be done with the webhook for the Git plugin, /git/notifyCommit . Which only works if you use the Git plugin. However, since we kinda need GitHub build status notifications for commits, we use that instead. Neither could I find an alternative for this webhook when using the GitHub plugin. Also, if we use some magic and trigger builds directly on the actual jobs themselves, this will have the side-effect that doing a re-index will also trigger a new build on the same job. Which means you have a lot of useless double builds clogging your build servers. For now, we are forced to use active polling, and poll GitHub for changes every 2 minutes. However, we really prefer not to have to do that.
            Hide
            jgogstad Jostein Gogstad added a comment - - edited

            Authentication tokens doesn't work, as Jesse pointed out. The following endpoints works for triggering indexing and builds in multibranch projects:

            curl -isk -u gitlab:5d7b834xxxxxxxxxxxxxxx6c1e0c9f3 -X POST https://myjenkins.internal.com/job/my_multibranch_job/job/Branches/build
            HTTP/1.1 302 Found
            ...
            

            It gives 302, but it both indexes and trigger builds on branches with new commits. Since the authentication token doesn't work, you'll have to use an user level authentication token and use it as password in a BASIC authentication scheme, you'll find the user authentication token under https://myjenkins.internal.com/user/USERNAME/configure (press "Show token"). If your SCM-vendor doesn't support explicitly specifying BASIC credentials (gitlab has no configuration for this), you can embed it in the url. Our push hook in GitLab is https://gitlab:5d7b834xxxxxxxxxxxxxxx6c1e0c9f3@myjenkins.internal.com/job/my_multibranch_job/job/Branches/build

            Finally if you want to trigger builds on specific branches in a multibranch pipeline, they can be triggered as such

            curl -isk -u gitlab:5d7b834xxxxxxxxxxxxxxx6c1e0c9f3 -X POST https://myjenkins.internal.com/job/my_multibranch_job/job/Branches/job/develop/build
            HTTP/1.1 201 Created
            

            Hope that helps

            Show
            jgogstad Jostein Gogstad added a comment - - edited Authentication tokens doesn't work, as Jesse pointed out. The following endpoints works for triggering indexing and builds in multibranch projects: curl -isk -u gitlab:5d7b834xxxxxxxxxxxxxxx6c1e0c9f3 -X POST https://myjenkins.internal.com/job/my_multibranch_job/job/Branches/build HTTP/1.1 302 Found ... It gives 302 , but it both indexes and trigger builds on branches with new commits. Since the authentication token doesn't work, you'll have to use an user level authentication token and use it as password in a BASIC authentication scheme, you'll find the user authentication token under https://myjenkins.internal.com/user/USERNAME/configure (press "Show token"). If your SCM-vendor doesn't support explicitly specifying BASIC credentials (gitlab has no configuration for this), you can embed it in the url. Our push hook in GitLab is https://gitlab:5d7b834xxxxxxxxxxxxxxx6c1e0c9f3@myjenkins.internal.com/job/my_multibranch_job/job/Branches/build Finally if you want to trigger builds on specific branches in a multibranch pipeline, they can be triggered as such curl -isk -u gitlab:5d7b834xxxxxxxxxxxxxxx6c1e0c9f3 -X POST https://myjenkins.internal.com/job/my_multibranch_job/job/Branches/job/develop/build HTTP/1.1 201 Created Hope that helps
            Hide
            truc Truc Nguyen added a comment -

            Hi,

            Just sharing kind of workaround here. My use case is to trigger branch indexing from GitHub webhook.
            Since using authentication token doesn't work with branch indexing, I created a "trigger" job (regular job type) which:
            1. Listens to GitHub webhook using authentication token
            2. Possibly parse GitHub payload to check for branch (refs)
            3. Trigger branch indexing on Multibranch pipeline job using:

            curl -sS -u basic_user:basic_password -X POST ${JENKINS_URL}/job/multibranch-pipeline-job/build?cause=GitHub+push
            

            So basically I have:

            [GitHub] --> [Trigger job] --> [Multibranch pipeline job]
            

            Adding this "trigger" job avoids active polling on the multibranch pipeline job.

            HTH

            Show
            truc Truc Nguyen added a comment - Hi, Just sharing kind of workaround here. My use case is to trigger branch indexing from GitHub webhook. Since using authentication token doesn't work with branch indexing, I created a "trigger" job (regular job type) which: 1. Listens to GitHub webhook using authentication token 2. Possibly parse GitHub payload to check for branch (refs) 3. Trigger branch indexing on Multibranch pipeline job using: curl -sS -u basic_user:basic_password -X POST ${JENKINS_URL}/job/multibranch-pipeline-job/build?cause=GitHub+push So basically I have: [GitHub] --> [Trigger job] --> [Multibranch pipeline job] Adding this "trigger" job avoids active polling on the multibranch pipeline job. HTH
            Hide
            jglick Jesse Glick added a comment -

            Neither could I find an alternative for this webhook when using the GitHub plugin.

            You need to install the github-branch-source plugin, which interprets GitHub webhooks.

            Show
            jglick Jesse Glick added a comment - Neither could I find an alternative for this webhook when using the GitHub plugin. You need to install the github-branch-source plugin, which interprets GitHub webhooks.
            Hide
            dnfehren Daniel Fehrenbach added a comment -

            Truc Nguyen thanks for the tip - was that basic_user:basic_password pair based on a Jenkins credentials object or something else?

            Show
            dnfehren Daniel Fehrenbach added a comment - Truc Nguyen thanks for the tip - was that basic_user:basic_password pair based on a Jenkins credentials object or something else?
            Hide
            tzafrir11 tzafrir added a comment - - edited

            This should be done with the webhook for the Git plugin, /git/notifyCommit.

            Jesse Glick I ended up doing just that and it works fine without requiring special permission. Yet post message to this address (as what gilab webhook provides) result with "no valid crumb was included in the request"

            Show
            tzafrir11 tzafrir added a comment - - edited This should be done with the webhook for the Git plugin, /git/notifyCommit. Jesse Glick I ended up doing just that and it works fine without requiring special permission. Yet post message to this address (as what gilab webhook provides) result with "no valid crumb was included in the request"
            Hide
            jglick Jesse Glick added a comment -

            Yet post message to this address (as what gilab webhook provides) result with "no valid crumb was included in the request"

            File an RFE for git-plugin.

            Show
            jglick Jesse Glick added a comment - Yet post message to this address (as what gilab webhook provides) result with "no valid crumb was included in the request" File an RFE for git-plugin .
            Hide
            jglick Jesse Glick added a comment -

            (a CrumbExclusion specifically)

            Show
            jglick Jesse Glick added a comment - (a CrumbExclusion specifically)

              People

              Assignee:
              jglick Jesse Glick
              Reporter:
              nmaclennan Norm MacLennan
              Votes:
              19 Vote for this issue
              Watchers:
              38 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: