robert wang added a comment - 2022-04-11 01:56 - edited me too Jenkins 2.342 / Role-based Authorization Strategy 3.2.0 role permission config is invalid. only Administrator can take effect.  

Francis added a comment - 2022-04-14 13:31 - edited Version 3.2.0 In a nutshell: Item roles for specific users are not taken into account Case 1: tata user logged out despite global and item roles "tata" user is logged out despite having global and item roles Manage Roles * Global Roles * admin : All privileges dev : Overall/Read * Item Roles * dev2 : All privileges, pattern Assign roles * Global role *   admin dev tata tata      X Anonymous     * Item roles *   dev2 tata tata   X Anonymous   Result Expected: for tata, full rights on jobs with the pattern defined in dev2 Observed: Access Denied: tata is missing the Overall/Read permission Case 2: Adding global role to Anonymous gives tata login, but no jobs showing * Global role *   admin dev tata tata     X Anonymous     X * Item roles *   dev2 tata tata   X Anonymous   Result Expected: for tata, ** full rights on jobs with pattern defined in dev, no rights without login Observed: tata logs in but no jobs visible Case 3: Adding global+item role to Anonymous gives tata rights * Global role *   admin dev tata tata    X Anonymous    X * Item roles *   dev2 tata tata  X Anonymous  X Result Works as expected: both tata and anonymous have full rights on jobs satisfying the pattern. But not satisfactory as we don't want anonymous to have build rights

Francis added a comment - 2022-04-15 12:28 - edited Worse: with LDAP, global role assigned to user has no effect at all. Plugin is unusable. jenkins 2.342 role-strategy@3.2.0 ldap@2.7 I have just 1 user and 2 global roles If I remove the admin role for Anonymous, I lose admin privileges when logged in as my user. Days spent deleting config.xml, reentering data, etc At one time I had a Jenkins user with the same name as my LDAP user, that might have confused things, but I deleted it and the error persists. Here is the config.xml extract. If I remove the line <sid>anonymous</sid> from <roleMap type="globalRoles">, I lose admin rights <authorizationStrategy class= "com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy" > <roleMap type= "slaveRoles" /> <roleMap type= "projectRoles" /> <roleMap type= "globalRoles" > <role name= "admin" pattern= ".*" > <permissions> <permission> hudson.model.View.Delete </permission> <permission> hudson.model.Computer.Connect </permission> <permission> hudson.model.Run.Delete </permission> <permission> com.cloudbees.plugins.credentials.CredentialsProvider.ManageDomains </permission> <permission> hudson.model.Computer.Create </permission> <permission> hudson.model.View.Configure </permission> <permission> hudson.model.Computer.Build </permission> <permission> hudson.model.Item.Configure </permission> <permission> hudson.model.Hudson.Administer </permission> <permission> hudson.model.Item.Cancel </permission> <permission> hudson.model.Item.Read </permission> <permission> com.cloudbees.plugins.credentials.CredentialsProvider.View </permission> <permission> hudson.model.Computer.Delete </permission> <permission> hudson.model.Item.Build </permission> <permission> org.jenkins.plugins.lockableresources.LockableResourcesManager.Unlock </permission> <permission> hudson.scm.SCM.Tag </permission> <permission> hudson.model.Item.Move </permission> <permission> hudson.model.Item.Discover </permission> <permission> hudson.model.Hudson.Read </permission> <permission> com.cloudbees.plugins.credentials.CredentialsProvider.Update </permission> <permission> org.jenkins.plugins.lockableresources.LockableResourcesManager.Steal </permission> <permission> hudson.model.Item.Create </permission> <permission> org.jfrog.hudson.ArtifactoryPlugin.Release </permission> <permission> hudson.model.Item.Workspace </permission> <permission> com.cloudbees.plugins.credentials.CredentialsProvider.Delete </permission> <permission> hudson.model.Computer.Provision </permission> <permission> hudson.model.Run.Replay </permission> <permission> hudson.model.View.Read </permission> <permission> org.jenkins.plugins.lockableresources.LockableResourcesManager.View </permission> <permission> hudson.model.View.Create </permission> <permission> hudson.model.Item.Delete </permission> <permission> org.jfrog.hudson.ArtifactoryPlugin.Promote </permission> <permission> hudson.model.Computer.Configure </permission> <permission> com.cloudbees.plugins.credentials.CredentialsProvider.Create </permission> <permission> hudson.model.Computer.Disconnect </permission> <permission> org.jenkins.plugins.lockableresources.LockableResourcesManager.Reserve </permission> <permission> hudson.model.Run.Update </permission> </permissions> <assignedSIDs> <sid> USER:fvila </sid> <sid> anonymous </sid> </assignedSIDs> </role> <role name= "dev" pattern= ".*" > <permissions> <permission> hudson.model.Hudson.Read </permission> <permission> hudson.model.Item.Cancel </permission> <permission> hudson.model.Item.Read </permission> <permission> hudson.model.Item.Build </permission> </permissions> <assignedSIDs> <sid> anonymous </sid> <sid> USER:fvila </sid> </assignedSIDs> </role> </roleMap> </authorizationStrategy>

Francis added a comment - 2022-04-15 14:40 I managed to solve the problem by editing the config.xml file directly. In admin's assignedSIDs , I gave my user 2 lines, one with USER:myname , the other with just myname <assignedSIDs> <sid> USER:fvila </sid> <sid> fvila </sid> </assignedSIDs>  In the UI, this shows fvila in red and with No type prefix: fvila.