Merging with JENKINS-45947 as I suspect there is a common cause.

I am still experiencing this issue as described.

This issue got closed because of JENKINS-45947, but that issue was never merged and closed as not reproducable without taking into account this linked issue.

I still experience this problem if the Folder permission is set to "Don't inherit" and you are not and admin but have all folder accesses then you will not see the "Open Blue Ocean" button.

Does this issue still occur in Matrix Auth Plugin 2.1 or newer with the revised options for permissions inheritance?

I was able to reproduce this problem and have found the cause. I consider this to be a bug in Blue Ocean: It checks the Overall/Read permission no matter in which context (folder, job, etc.) the sidepanel link would be displayed.

https://github.com/jenkinsci/blueocean-plugin/blob/77960a8dc21840ae5f6df784a26f91e09d7da621/blueocean-rest-impl/src/main/resources/io/jenkins/blueocean/service/embedded/BlueOceanUrlAction/action.jelly#L8

Global permissions are expected to not matter in the context of a folder, so the combination of not being able to grant them on a folder level, and not inheriting them from the global ACL, results in this permission check to fail if and only if you're in such a folder (or job – the same applies to jobs that don't inherit permissions).

While an argument could be made that Matrix Auth should always inherit Overall/Read (the same way Overall/Administer is – since Matrix Auth 2.0 – always inherited) for compatibility with buggy plugins, this is ultimately, IMO, a Blue Ocean bug.

FWIW the permission check here makes no sense anyway, as the link would not be displayed to anyone without Overall/Read permission. It only governs whether they can see the link, not whether they can get access.

Remove the linked line in the Jelly file and you're done. Someone up for some easy karma?

You need Overall/Read to do anything except use an UnprotectedRootAction, so explicitly checking it makes little sense. Anyway, I am not sure why matrix-auth would be blocking inheritance of Overall/* permissions, but it should not matter since they should only ever be checked on Jenkins to begin with. (I used to want to actually enforce PermissionScope at runtime, but there are some corner cases that would be tricky to fix compatibly.) So agreed that just removing that line from action.jelly should suffice.

FYI I asked about this in https://groups.google.com/d/msg/jenkinsci-dev/kg4UVxJ4gQQ/os-aPg85CAAJ

Is there any movement on this? Users are complaining the blue ocean button is not there. I have resorted to inheriting the permissions and adding but this is not ideal

This is also an issue with the github-oauth plugin. I'm going to try danielbeck's suggestion.

Pull Request: https://github.com/jenkinsci/blueocean-plugin/pull/2086