the same error occurs in 1.352.

C:\Work\hudson>java -jar hudson-cli.jar -s http://localhost:8080/hudson login –
username admin
Exception in thread "main" java.io.IOException: Server returned HTTP response code: 403 for URL: http://localhost:8080/hudson/cli
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at hudson.cli.FullDuplexHttpStream.<init>(FullDuplexHttpStream.java:51)
at hudson.cli.CLI.<init>(CLI.java:90)
at hudson.cli.CLI.<init>(CLI.java:62)
at hudson.cli.CLI.main(CLI.java:171)

only when I allow the user Anonymous Overall Read permission I can login:
C:\Work\hudson>java -jar hudson-cli.jar -s http://localhost:8080/hudson login --username admin
Password:
C:\Work\hudson>

I believe it should be possible to fully lockdown Hudson without allowing Anonymous any access rights.

There is information leak with Anonymous Overall Read permission following the People URL (http://localhost:8080/hudson/people/), users details are exposed and accessible.

I'm trying to use CLI in 1.355 in authenticated mode.
Login command seems to work - returns nothing. But when i try to run any other (f.e. groovysh) command after login it says that anonymous is missing Administer permission. Also i was trying to run groovysh like this:

java -jar hudson-cli.jar -s ServerURL groovysh --username adminuser --password correctpass and it says the same.

The only thing i was able to perform so far is to quiet-down

This same issue is also preventing our server from automagically restarting itself unless the Anonymous user has full admin rights over hudson

(we are using Project-based Matrix Authorization Strategy )

When running :
java -jar hudson-cli.jar -s ServerURL login --username <an admin user> --password <the good one>
It tells me :
"--username" is not a valid option

We are running Hudson 1.359 with Matrix Based Security connected to a LDAP server, on a TOMCAT server.

This question becomes critical for us, because we really need to use security and want to extract some data to build our own metrics.
So, I tried the same on both Unix or Windows client and the same occurs.

Nevertheless, when using wget, I can give the credentials via :
http://username:pass@HudsonURL
For ex :
http://username:pass@HudsonURL/quietDown

And it works correctly.
The same command using java -jar does not work, saying that --username is not a valid option

Considering that the credentials are correctly passed using wget and not with the Hudson-cli jar,
I suppose there is something wrong with the CLI jar.

abarbieri, what is the current status of this issue? What security realm type do you use? I'm looking into JENKINS-6628 now (fixing LDAP security realm so it accepts --username/password parameters.. jlpinardon, this is what you mention in your comment above).. any other problems you see in CLI authentication in the latest Hudson release?

will provide feedback later today for these two types of security realms

• LDAP
• Hudson

using hudson version 1.371

when I use the help command I read:
...
login
Saves the current credential to allow future commands to run without explicit credential information
logout
Deletes the credential stored with the login command

so if one performs:
java -jar hudson-cli.jar -s http://localhost:8080/hudson login --username admin
Password:
and logs is successfully... why do I get this?
java -jar hudson-cli.jar -s http://localhost:8080/hudson groovysh

Exception in thread "main" java.lang.reflect.UndeclaredThrowableException
at $Proxy2.main(Unknown Source)
at hudson.cli.CLI.execute(CLI.java:131)
at hudson.cli.CLI.main(CLI.java:180)
Caused by: hudson.remoting.ProxyException: hudson.security.AccessDeniedException
2: anonymous is missing the Administer permission
at hudson.security.ACL.checkPermission(ACL.java:53)
at hudson.model.Node.checkPermission(Node.java:310)
at hudson.cli.GroovyshCommand.main(GroovyshCommand.java:61)
at hudson.cli.CliManagerImpl.main(CliManagerImpl.java:68)
at sun.reflect.GeneratedMethodAccessor110.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at hudson.remoting.RemoteInvocationHandler$RPCRequest.perform(RemoteInvocationHandler.java:274)
at hudson.remoting.RemoteInvocationHandler$RPCRequest.call(RemoteInvocationHandler.java:255)
at hudson.remoting.RemoteInvocationHandler$RPCRequest.call(RemoteInvocationHandler.java:215)
at hudson.remoting.UserRequest.perform(UserRequest.java:114)
at hudson.remoting.UserRequest.perform(UserRequest.java:48)
at hudson.remoting.Request$2.run(Request.java:270)
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
at java.util.concurrent.FutureTask$Sync.innerRun(Unknown Source)
at java.util.concurrent.FutureTask.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

the Anonymous user has all permissions disabled.