Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-57154

Regression in github-oauth-plugin 0.32 breaks /configureSecurity page

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Critical Critical
    • github-oauth-plugin
    • None
    • OS: Ubuntu 18.04.2 - 64 bit
      Java: openjdk version "1.8.0_191"
      github-oauth-plugin: 0.32
      Jenkins: 2.164.2
    • github-oauth-0.33

      After upgrading to github-oauth-plugin 0.32 I started to see this error in /configureSecurity when it tries to retrieve the name of a github user:

      HTTP ERROR 403
Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
Reason:    Forbidden

       

      The first user has its name retrieved successfully but all others have the error mentioned above.

       

      See the attachment users.png.

       

      The workaround for now is revert to 0.31.

        1. users.png
          users.png
          29 kB

          [JENKINS-57154] Regression in github-oauth-plugin 0.32 breaks /configureSecurity page

          Francisco Guimaraes created issue -
          Francisco Guimaraes made changes -
          Description Original: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName. Reason: Forbidden
          {noformat}
           

          The first user is has its name retrieved successfully but all others has the error mentioned above.

           

          See the attachment *users.png*.           		New: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user is has its name retrieved successfully but all others has the error mentioned above.

           

          See the attachment *users.png*.
          Francisco Guimaraes made changes -
          Description Original: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user is has its name retrieved successfully but all others has the error mentioned above.

           

          See the attachment *users.png*.           		New: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user is has its name retrieved successfully but all others hve the error mentioned above.

           

          See the attachment *users.png*.
          Francisco Guimaraes made changes -
          Description Original: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user is has its name retrieved successfully but all others hve the error mentioned above.

           

          See the attachment *users.png*.           		New: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user is has its name retrieved successfully but all others have the error mentioned above.

           

          See the attachment *users.png*.
          Francisco Guimaraes made changes -
          Attachment Original: users.png [ 46854 ]
          Francisco Guimaraes made changes -
          Attachment New: users.png [ 46855 ]
          Francisco Guimaraes made changes -
          Description Original: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user is has its name retrieved successfully but all others have the error mentioned above.

           

          See the attachment *users.png*.           		New: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user has its name retrieved successfully but all others have the error mentioned above.

           

          See the attachment *users.png*.
          Francisco Guimaraes made changes -
          Description Original: After upgrading to github-oauth-plugin 0.32 I started to see this error in `/configureSecurity` when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user has its name retrieved successfully but all others have the error mentioned above.

           

          See the attachment *users.png*.           		New: After upgrading to github-oauth-plugin 0.32 I started to see this error in */configureSecurity* when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user has its name retrieved successfully but all others have the error mentioned above.

           

          See the attachment *users.png*.
          Francisco Guimaraes made changes -
          Description Original: After upgrading to github-oauth-plugin 0.32 I started to see this error in */configureSecurity* when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user has its name retrieved successfully but all others have the error mentioned above.

           

          See the attachment *users.png*.           		New: After upgrading to github-oauth-plugin 0.32 I started to see this error in */configureSecurity* when it tries to retrieve the name of a github user:
          {noformat}
          HTTP ERROR 403
          Problem accessing /descriptorByName/hudson.security.ProjectMatrixAuthorizationStrategy/checkName.
          Reason: Forbidden
          {noformat}
           

          The first user has its name retrieved successfully but all others have the error mentioned above.

           

          See the attachment *users.png*.

           

          The workaround for now is revert to 0.31.

          Ionut Balutoiu added a comment -

          This issue affects me as well.

          Considering that version 0.31 is affected by a CSRF vulnerability (https://jenkins.io/security/advisory/2019-04-30/#SECURITY-443), do you guys have any ETA for fixing this, so we can update to 0.32 as soon as possible ?

          Without any workaround for this issue, it's hard to maintain a Matrix-based security authorization using 0.32, since you'll get error 403 for every user present there.

           

          Thank-you,

          Ionut

          Ionut Balutoiu added a comment - This issue affects me as well. Considering that version  0.31 is affected by a CSRF vulnerability ( https://jenkins.io/security/advisory/2019-04-30/#SECURITY-443 ), do you guys have any ETA for fixing this, so we can update to  0.32 as soon as possible ? Without any workaround for this issue, it's hard to maintain a Matrix-based security authorization using 0.32 , since you'll get error 403 for every user present there.   Thank-you, Ionut

            sag47 Sam Gleske
            franciscocpg Francisco Guimaraes
            Votes:
            27 Vote for this issue
            Watchers:
            36 Start watching this issue

              Created:
              Updated:
              Resolved: