• Type: New Feature
• Resolution: Unresolved
• Priority: Major
• Component/s: authorize-project-plugin
• Labels:

  • authorization
  • folders
  • permissions
  • pipeline

[JENKINS-50559] Authorization Folder property for Multibranch jobs

Allan BURDAJEWICZ created issue - 2018-04-04 03:36

Jesse Glick made changes - 2018-04-04 13:26

Component/s	Original: workflow-multibranch-plugin [ 21465 ]
Description	Original: h3. Request I would like to set up Authorization ([Authorize Project plugin|https://plugins.jenkins.io/authorize-project]) for a Multibranch item. Setting up authorization at multibranch level is required to prevent branch projects to be able to build ANY project in the system. h3. Workaround A workaround is to set the Authorize project property from the Jenkinsfile but there is no special support for multibranch projects.	New: I would like to set up Authorization ([Authorize Project plugin|https://plugins.jenkins.io/authorize-project]) for a Multibranch item. Setting up authorization at multibranch level is required to prevent branch projects to be able to build ANY project in the system.
Labels	Original: authorization permissions	New: authorization folders permissions pipeline

Collapse comment: Amir Barkal added a comment - 2018-11-05 17:20

Amir Barkal added a comment - 2018-11-05 17:20

Any progress on this one?

I have a very basic use case requiring this feature:
Store and sync job definitions from scm (GitHub for example) using jobDSL syntax. Currently this seems to be impossible.

For the jobDSL() step to work without forcing an administrator to approve changes manually, you need to run the jobDSL in sandbox mode. Sandbox mode works only when you configure a job to run as a specific user.

Unfortunately the Authorize Project Plugin does not seem to support Multi-Branch pipeline job definition.

Expand comment: Amir Barkal added a comment - 2018-11-05 17:20

Amir Barkal added a comment - 2018-11-05 17:20 Any progress on this one? I have a very basic use case requiring this feature: Store and sync job definitions from scm (GitHub for example) using jobDSL syntax. Currently this seems to be impossible. For the jobDSL() step to work without forcing an administrator to approve changes manually, you need to run the jobDSL in sandbox mode. Sandbox mode works only when you configure a job to run as a specific user . Unfortunately the Authorize Project Plugin does not seem to support Multi-Branch pipeline job definition.

Collapse comment: Damien Roche added a comment - 2019-02-08 11:45

Damien Roche added a comment - 2019-02-08 11:45

Running into the same use case as amirbarkal has mentioned above.

Expand comment: Damien Roche added a comment - 2019-02-08 11:45

Damien Roche added a comment - 2019-02-08 11:45 Running into the same use case as amirbarkal has mentioned above.

Collapse comment: Michel Zanini added a comment - 2019-11-26 14:53

Michel Zanini added a comment - 2019-11-26 14:53

I have two folders that will be visible and accessible by different users.
To avoid a pipeline step to trigger a job on the other folder I can't run jobs with the default SYSTEM user.
I need to use Authorize Project plugin to change to run with a specific user.
However, how can I configure a folder and sub-items to run with a specific user?
I can only do that on Global Jenkins level, but I need to override the global definition on this 2 folders.
The ticket here mentions support for multi-branch pipelines, I guess normal folders also apply. Possibly implementing for one will do for the other.

Expand comment: Michel Zanini added a comment - 2019-11-26 14:53

Michel Zanini added a comment - 2019-11-26 14:53 I have two folders that will be visible and accessible by different users. To avoid a pipeline step to trigger a job on the other folder I can't run jobs with the default SYSTEM user. I need to use Authorize Project plugin to change to run with a specific user. However, how can I configure a folder and sub-items to run with a specific user? I can only do that on Global Jenkins level, but I need to override the global definition on this 2 folders. The ticket here mentions support for multi-branch pipelines, I guess normal folders also apply. Possibly implementing for one will do for the other.