-
Bug
-
Resolution: Cannot Reproduce
-
Critical
This refers to LDAP plugin. Exactly the same issue was raised and fixed against github-auth plugin in the past.
It seems that the option to allow anonymous users to read the /cc.xml works only for the root one and not for those associated with other views, or the special "all" view which is exposed at /view/All/cc.xml
This bug has a serious impact because due to it, it means that you can only expose the status of the jobs present on the default view. On any serious setup, the default view does not expose ALL jobs.
Even worse, it seems that if you try to get the other cc.xml files you get a 403 but if you try to use basic auth, you will get a 500 error.
- is related to
-
JENKINS-2885 Not all jobs show-up in cc.xml report
-
- Closed
-
- links to
[JENKINS-48896] anonymous read of cc.xml file works only for root (ldap)
| Link |
New:
This issue is related to |
| Remote Link | New: This issue links to "pull-52 (Web Link)" [ 19762 ] |
| Component/s | New: ldap-plugin [ 17122 ] | |
| Component/s | Original: github-oauth-plugin [ 15900 ] |
| Description |
Original:
It seems that the option to allow anonymous users to read the /cc.xml works only for the root one and not for those associated with other views, or the special "all" view which is exposed at /view/All/cc.xml This bug has a serious impact because due to it, it means that you can only expose the status of the jobs present on the default view. On any serious setup, the default view does not expose ALL jobs. Even worse, it seems that if you try to get the other cc.xml files you get a 403 but if you try to use basic auth, you will get a 500 error. Ideally the github integration plugin should expose github login as basic auth, so we can use it from other applications too. Still, this would be subject to a different bug report. |
New:
This refers to LDAP plugin. Exactly the same issue was raised and fixed against github-auth plugin in the past. It seems that the option to allow anonymous users to read the /cc.xml works only for the root one and not for those associated with other views, or the special "all" view which is exposed at /view/All/cc.xml This bug has a serious impact because due to it, it means that you can only expose the status of the jobs present on the default view. On any serious setup, the default view does not expose ALL jobs. Even worse, it seems that if you try to get the other cc.xml files you get a 403 but if you try to use basic auth, you will get a 500 error. |
| Assignee | Original: Sam Gleske [ sag47 ] | New: Kohsuke Kawaguchi [ kohsuke ] |
| Component/s | New: cctray-xml-plugin [ 21967 ] |
| Component/s | New: core [ 15593 ] |
It is not clear to me what this is even referring to. The option mentioned, AFAICT, is specific to github-oauth plugin. So it'd be a bug if any cc.xml were accessible without Overall/Read permission.
CC danielbeck and dnusbaum who were working on this area recently