Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-47339

Add Rebuild action for users who can Build but not Replay (was: Users with only Job/Configure shouldn't be able to replay jobs)

XMLWordPrintable

    • Pipeline - October, Pipeline - December

      As a Jenkins administrator, I would like for developers to be able to configure jobs, but only have certain users able to build those jobs. Through various means like RBAC and controlled agents, I have given jobs in a certain folder the ability to access agents and secrets. While I trust developers to configure those jobs, I have business requirements to only allow certain users to build those jobs.

      However, Jenkins allows users to Replay a build even if they don't have the Run/Replay or Job/Build permissions. This seems to due the fact that Run/Replay is implied by Job/Configure.

      Put another way, Job/Build isn't implied by Job/Configure, so why does Job/Configure imply Run/Replay? Instead, it seems like Run/Replay should only be implied if a user has both Job/Build and Job/Configure.

          [JENKINS-47339] Add Rebuild action for users who can Build but not Replay (was: Users with only Job/Configure shouldn't be able to replay jobs)

          James Dumay created issue -
          James Dumay made changes -
          Rank New: Ranked higher
          James Dumay made changes -
          Component/s New: pipeline [ 21692 ]
          James Dumay made changes -
          Sprint New: Pipeline - October [ 406 ]

          Andrew Bayer added a comment -

          Ok, thought about this a bit - ReplayAction.REPLAY should be implied by Item.CONFIGURE. That's because replaying a build lets you make changes to what was run. So we definitely don't want to just allow anyone with Item.BUILD permissions to be able to replay a build unless they also have Item.CONFIGURE. And since, as far as I know, there's no way to do two required permissions to imply a third, we're restricted to having ReplayAction.REPLAY implied by one of Item.CONFIGURE or Item.BUILD but not the other, and in that scenario, Item.CONFIGURE is definitely the right one.

          Andrew Bayer added a comment - Ok, thought about this a bit - ReplayAction.REPLAY should be implied by Item.CONFIGURE . That's because replaying a build lets you make changes to what was run. So we definitely don't want to just allow anyone with Item.BUILD permissions to be able to replay a build unless they also have Item.CONFIGURE . And since, as far as I know, there's no way to do two required permissions to imply a third, we're restricted to having ReplayAction.REPLAY implied by one of Item.CONFIGURE or Item.BUILD but not the other, and in that scenario, Item.CONFIGURE is definitely the right one.

          James Nord added a comment -

          abayer Just pointing out for clarity that a permission does not have to be implied by any other permission, because the above seems to imply it must have an implied by..

          James Nord added a comment - abayer Just pointing out for clarity that a permission does not have to be implied by any other permission, because the above seems to imply it must have an implied by..

          Jesse Glick added a comment -

          The current behavior is correct and this should be closed.

          Jesse Glick added a comment - The current behavior is correct and this should be closed.
          Andrew Bayer made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          Andrew Bayer made changes -
          Status Original: In Progress [ 3 ] New: In Review [ 10005 ]

          Andrew Bayer added a comment -

          PR up for workflow-cps at https://github.com/jenkinsci/workflow-cps-plugin/pull/187 that adds a new ReplayAction.REBUILD permission (implied by Item.BUILD) for simply re-running a build with the same script, i.e., without the ability to edit the script contents.

          Andrew Bayer added a comment - PR up for workflow-cps at https://github.com/jenkinsci/workflow-cps-plugin/pull/187 that adds a new ReplayAction.REBUILD permission (implied by Item.BUILD ) for simply re-running a build with the same script, i.e., without the ability to edit the script contents.
          Andrew Bayer made changes -
          Remote Link New: This issue links to "workflow-cps PR #187 (Web Link)" [ 17997 ]

            abayer Andrew Bayer
            jamesdumay James Dumay
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: