Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-60897

JEP-225: Folders-based access control for any credentials provider

    XMLWordPrintable

    Details

    • Epic Name:
      JEP-225: Folders-based access control layer for any credentials provider
    • Similar Issues:

      Description

      Today the folders plugin provides an access control layer over its own local credentials provider. This works, but it means that if a user wants to restrict access to a particular credential by folder, they cannot store it in their preferred provider: instead they must copy it into the FolderCredentialsProvider.

      I would like to extend the plugin so that it can provide its access control layer (ACL) over any credentials provider.

      Benefits

      • Only write the access control logic once. Today, other providers would have to copy-paste the intricate ACL logic from the folders plugin, and then keep that up to date with any changes. Mistakes will inevitably be made.
      • It works the same way everywhere. Folders-based ACL will not have provider-specific behaviour, or a provider-specific storage schema for the ACL.
      • ACL can be written in JCasC YAML. Each folder entry just needs to have a list of allowed credential IDs.
      • Single Responsibility Principle. Providers do one thing: store and retrieve credentials. Folders plugin does one thing (for credentials): run the ACL over the providers.

      Tasks

      TODO convert these to sub-tasks

      • Design JCasC YAML schema for the ACL
      • Design Web UI for the ACL
      • Decide on default behaviour when folders plugin is present, a job accesses a credential, but no restrictions are configured for that credential:
        • Default allow? (Treat it as a global credential)
        • Default deny? (Don't ask, don't get)
      • Make ACL work with other folder types (GitHub/Bitbucket Organization Folders)
      • Deprecate/remove legacy bits of CredentialsProvider / CredentialsStore API that were meant to be used for access control (since it would not be their job any more)
      • Ensure ease of use with infrastructure tools like Terraform (it should be as simple as possible to have Terraform define Secrets Manager secrets, then interpolate the relevant IDs into the JCasC YAML).

        Attachments

          Issue Links

            Activity

            Hide
            chriskilding Chris Kilding added a comment -

            JENKINS-58951 is to implement JCasC support for the folders plugin. This might need to be implemented before we can add the ACL on top.

            Show
            chriskilding Chris Kilding added a comment - JENKINS-58951 is to implement JCasC support for the folders plugin. This might need to be implemented before we can add the ACL on top.

              People

              Assignee:
              chriskilding Chris Kilding
              Reporter:
              chriskilding Chris Kilding
              Votes:
              6 Vote for this issue
              Watchers:
              6 Start watching this issue

                Dates

                Created:
                Updated: