Details
-
Type:
Bug
-
Status: Resolved (View Workflow)
-
Priority:
Critical
-
Resolution: Fixed
-
Component/s: aws-global-configuration-plugin
-
Labels:None
-
Environment:CloudBees Core 2.150.2.3 w/ CAP enabled
artifact-manager-s3 plugin v1.1
-
Similar Issues:
-
Released As:1.2
Description
Users without Overall/Administrator are not able to view artifacts in the UI or download them. In the Jenkins log, I'm seeing the following traceback (full details in attachment):
"February 6th 2019, 17:01:48.696","Feb 06, 2019 5:01:48 PM hudson.model.Run getArtifactsUpTo" "February 6th 2019, 17:01:48.696","WARNING: null" "February 6th 2019, 17:01:48.697"," at io.jenkins.plugins.artifact_manager_jclouds.JCloudsVirtualFile.run(JCloudsVirtualFile.java:328)" "February 6th 2019, 17:01:48.697","java.io.IOException: hudson.security.AccessDeniedException2: mat007 is missing the Overall/Administer permission" "February 6th 2019, 17:01:48.698"," at hudson.model.Run.getArtifactsUpTo(Run.java:1104)" "February 6th 2019, 17:01:48.698"," at io.jenkins.blueocean.service.embedded.rest.AbstractRunImpl.getArtifactsZipFile(AbstractRunImpl.java:278)" "February 6th 2019, 17:01:48.698"," at hudson.model.Run.getHasArtifacts(Run.java:1121)" "February 6th 2019, 17:01:48.699"," at io.jenkins.blueocean.commons.stapler.export.ExportInterceptor$1.getValue(ExportInterceptor.java:46)" "February 6th 2019, 17:01:48.699"," at io.jenkins.blueocean.commons.stapler.export.MethodProperty.getValue(MethodProperty.java:72)" ... snip ...
Attachments
Issue Links
Activity
| Field | Original Value | New Value |
|---|---|---|
| Assignee | Jesse Glick [ jglick ] |
| Component/s | aws-global-configuration-plugin [ 23929 ] | |
| Component/s | artifact-manager-s3-plugin [ 23538 ] | |
| Priority | Major [ 3 ] | Critical [ 2 ] |
FWIW, I also just noticed that the traceback log output is not guaranteed to be in-order either (for a given timestamp)...
Peter Salvatore not sure what that means. Maybe something related to the logging system used in CloudBees Core. If so, please report it through vendor channels, so this issue can be focused on the inappropriate AccessDeniedException2.
Jesse Glick The log record ordering issue is an artifact of our logging system, nothing to do with Jenkins. The effect is that some records in the attached artifacts.log may not be in exactly the same order as what Jenkins emitted.
| Status | Open [ 1 ] | In Progress [ 3 ] |
| Remote Link | This issue links to "aws-global-configuration PR 8 (Web Link)" [ 22405 ] |
Peter Salvatore understood. Does not matter in this case as I can reproduce what appears to be an identical issue in a functional test anyway.
| Remote Link | This issue links to "artifact-manager-s3 PR 86 (Web Link)" [ 22406 ] |
| Status | In Progress [ 3 ] | In Review [ 10005 ] |
| Remote Link | This issue links to "CloudBees-internal link (Web Link)" [ 22407 ] |
| Released As | 1.2 | |
| Resolution | Fixed [ 1 ] | |
| Status | In Review [ 10005 ] | Resolved [ 5 ] |
Just upgraded to aws-global-configuration:1.2 and can confirm the fix in my environment. Thank you!
The critical part of the stack is what was snipped out: the fact CredentialsAwsGlobalConfiguration.getCredentials is checking ADMINISTER.