Details
-
Type:
Bug
-
Status: Open (View Workflow)
-
Priority:
Major
-
Resolution: Unresolved
-
Component/s: core
-
Labels:
-
Environment:Jenkins 2.148
Jenkins 2.138.2
-
Similar Issues:
Description
Creating a user (via Manage Jenkins -> Manage Users -> Create User) with a name containing a dot (".") returns HTTP/1.1 200 but does not create user and remains on same page. I can not find this behavior documented anywhere, and in an older Jenkins version I was able to create users with dots in their name. Currently I have several users with dots in their name, but I can no longer create new ones.
Attachments
Activity
We've been hit by this bug for quite some time. I just did bisection and this is what I found:
2.120 is the last version that allows you to create users with dots.
2.121 onwards: block usernames with dots, with the following warning: User name must only contain alphanumeric characters, underscore and dash.
2.128 onwards: user isn't created, stays on the same page, no warning is shown (reported behaviour)
Does that mean dots are disallowed in usernames by design? If so, what's the motivation behind it?
Alba Mendez
added a comment - We've been hit by this bug for quite some time. I just did bisection and this is what I found:
2.120 is the last version that allows you to create users with dots.
2.121 onwards: block usernames with dots, with the following warning: User name must only contain alphanumeric characters, underscore and dash.
2.128 onwards: user isn't created, stays on the same page, no warning is shown (reported behaviour)
Does that mean dots are disallowed in usernames by design? If so, what's the motivation behind it? 2.138.2 version also affected.
And I suppose need to check also LDAP login with dot.
Installed via package manager in Ubuntu Server
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.1 LTS"
Boris Osyanin
added a comment - - edited 2.138.2 version also affected.
And I suppose need to check also LDAP login with dot.
Installed via package manager in Ubuntu Server
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.1 LTS"
Rick Löhlefink 
Okay it's from design. This is the relevant security change in 2.121 that restricts usernames:
Setting the mentioned hudson.security.HudsonPrivateSecurityRealm.ID_REGEX system property at startup to ^[a-zA-Z0-9_.-]+$ works
An error message like "Invalid username. By default, usernames must only contain alphanumeric characters, underscore and dash." should be shown.