Hm, I may miss your point, but adding the new type prefix works for us in Job DSL scripts – note however, that this only worked when I added the non-default group search filter for LDAP configuration, cf. JENKINS-67410; maybe try to test LDAP server settings if group retrieval/search works:

folder('FolderName') { 
  properties {
    authorizationMatrix {
      inheritanceStrategy {
          nonInheriting()
      }
      permissions([
          // Readonly user    
          'GROUP:Job/Read:group-from-ldap', 
...

reinholdfuereder: Thanks for the hint with the "properties/authorizationMatrix"; this also works in our setup and could be a solution.

We use Active Directory instead of LDAP, so the "Group not found" issue does not apply.

In the Job DSL scripts, we have used the following so far:

folder('FolderName') {
  authorization {
    permissionAll(user-from-AD)
    permissions(user-from-AD, [ 'hudson.model.Item.Read', 'hudson.model.Item.Build', 'hudson.model.Item.Workspace'])
    ...
  }
...

I hoped that the permission commands have been/could be extended with an argument for GROUP/USER, so we do not have to rework our scripts too much, but we have to touch them anyway.

For the "properties/authorizationMatrix" is there a way to have a "permissionAll" or is it working just like one permission for one group/user per line?

Is there a solution to this yet ? I am facing same issue with matrix auth 3.0.

Following works fine, but results in a warning on UI:

_authorization

_

When I try changing it to:

_authorization

_

I get error:

ERROR: (unknown source) permission must be one of com.cloudbees.plugins.credentials.CredentialsProvider.Create,com.cloudbees.plugins.credentials.CredentialsProvider.Delete,com.cloudbees.plugins.credentials.CredentialsProvider.ManageDomains,com.cloudbees.plugins.credentials.CredentialsProvider.Update,com.cloudbees.plugins.credentials.CredentialsProvider.View,hudson.model.Item.Build,hudson.model.Item.Cancel,hudson.model.Item.Configure,hudson.model.Item.Delete,hudson.model.Item.Discover,hudson.model.Item.Move,hudson.model.Item.Read,hudson.model.Item.Workspace,hudson.model.Run.Delete,hudson.model.Run.Replay,hudson.model.Run.Update,hudson.scm.SCM.Tag

richmond I struggled with this workaround too and got the same error as you. The key is to not use the permissions() method off of authorization, because that's a method defined by the DSL which is not updated to support the new syntax. You have to start at the job level and get all the way to the the authorizationMatrix. The other problem might be the way you specify the permission because this is technically a different permissions() method.

You want to try something more like this but you'll have to replace jobvar with whatever your variable that represents the job is:

jobvar.properties {
  authorizationMatrix {
    permissions([ "GROUP:Job/Read:${this.myADGroup}", "GROUP:Job/Configure:${this.myADGroup}" ])
  }
}

Hit this a month ago (linux container host version 2.332.3 with job dsl plugin 1.79) and just got around to hacking together a fix for my pipelines. I wasn't able to get the simple permissions( ) list to work with the versions of plugins I have, and ended up writing configure blocks to manipulate the auth xml blocks.
 

def matrix = it / 'properties' /'hudson.security.AuthorizationMatrixProperty'
matrix / inheritanceStrategy(class: "org.jenkinsci.plugins.matrixauth.inheritance.InheritParentStrategy")
matrix.appendNode('permission', "GROUP:com.cloudbees.plugins.credentials.CredentialsProvider.Create:${myADGroup}".toString())

 It's gross but worked.

My team was able to work around this just recently with the following syntax, which does not delve into the messy configure blocks:
 
            properties {
                authorizationMatrix {
                    users.each

                    groups.each

                    permissionMatrix.add("GROUP:hudson.model.Item.Read:authenticated")
                    permissions(permissionMatrix)
                }

            }

Anyone want to confirm that the *authorizationMatrix{ permissions

}* works for them?

I can, properly sets permissions and removes warning

    multibranchPipelineJob(jobName) {
        properties {
            authorizationMatrix {
                permissions(['GROUP:hudson.model.Item.Build:authenticated'])
            }
        }
... 

For the "properties/authorizationMatrix" is there a way to have a "permissionAll" or is it working just like one permission for one group/user per line?

I guess this can be achieved by granting "Overall/Administer", right?

Could someone please translate the (Job-DSL) example from akrapfl  above into the new "entries {}" based syntax? I tried 

 properties {
  authorizationMatrix {
    entries {
      config['authorization'].each { entry ->
        if (entry['type'] == 'group') {
          group {
            name(entry['name'])
            permissions(entry['permissions'])
          }
        }
        else {
          user {
            name(entry['name'])
            permissions(entry['permissions'])
          }
        }
      }
    }
    inheritanceStrategy {
      nonInheriting()
    }
  }
}

but that only results in the two empty default entries for "anonymous" and "authenticated" being added to the job.

See JENKINS-72263 for a follow-up on my previous comment.

Fixed in jenkinsci/job-dsl-plugin#1415. Released in 1.88.