-
Bug
-
Resolution: Unresolved
-
Major
-
Jenkins 2.148
Jenkins 2.138.2
Creating a user (via Manage Jenkins -> Manage Users -> Create User) with a name containing a dot (".") returns HTTP/1.1 200 but does not create user and remains on same page. I can not find this behavior documented anywhere, and in an older Jenkins version I was able to create users with dots in their name. Currently I have several users with dots in their name, but I can no longer create new ones.
[JENKINS-54311] Create user with . in name doesn't work
Rick Löhlefink
created issue -
Boris Osyanin
made changes -
| Priority | Original: Minor [ 4 ] | New: Major [ 3 ] |
Boris Osyanin
made changes -
| Environment | Original: Jenkins 2.148 |
New:
Jenkins 2.148 Jenkins 2.138.2 |
Boris Osyanin
made changes -
| Labels | New: user |
Boris Osyanin
made changes -
| Labels | Original: user | New: management user |
Alba Mendez
added a comment - We've been hit by this bug for quite some time. I just did bisection and this is what I found:
2.120 is the last version that allows you to create users with dots.
2.121 onwards: block usernames with dots, with the following warning: User name must only contain alphanumeric characters, underscore and dash.
2.128 onwards: user isn't created, stays on the same page, no warning is shown (reported behaviour)
Does that mean dots are disallowed in usernames by design? If so, what's the motivation behind it?
Alba Mendez
added a comment - We've been hit by this bug for quite some time. I just did bisection and this is what I found:
2.120 is the last version that allows you to create users with dots.
2.121 onwards: block usernames with dots, with the following warning: User name must only contain alphanumeric characters, underscore and dash.
2.128 onwards: user isn't created, stays on the same page, no warning is shown (reported behaviour)
Does that mean dots are disallowed in usernames by design? If so, what's the motivation behind it? Alba Mendez
made changes -
| Attachment | New: Screenshot from 2018-11-20 17.51.08.png [ 45229 ] |
Alba Mendez
added a comment - Okay it's from design. This is the relevant security change in 2.121 that restricts usernames:
Setting the mentioned hudson.security.HudsonPrivateSecurityRealm.ID_REGEX system property at startup to ^[a-zA-Z0-9_.-]+$ works 
An error message like "Invalid username. By default, usernames must only contain alphanumeric characters, underscore and dash." should be shown.
Alba Mendez
added a comment - Okay it's from design. This is the relevant security change in 2.121 that restricts usernames:
Setting the mentioned hudson.security.HudsonPrivateSecurityRealm.ID_REGEX system property at startup to ^ [a-zA-Z0-9_.-] +$ works
An error message like "Invalid username. By default, usernames must only contain alphanumeric characters, underscore and dash." should be shown.
2.138.2 version also affected.
And I suppose need to check also LDAP login with dot.
Installed via package manager in Ubuntu Server
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.1 LTS"
rlohlefink