Problem Statement

As a Jenkins power-user, I want to configure which people can access/run/configure which jobs.

As a Jenkins admin, I want to enable the power-user. However, I do not want to give them full admin permissions.

Proposed Solution

Currently the https://github.com/jenkinsci/role-strategy-plugin/blob/4fe2599cbf48f1bc1469467ff850168893cacbb3/src/main/resources/com/michelin/cio/hudson/plugins/rolestrategy/RoleStrategyConfig/index.jelly#L34has an all or nothing approach. Either admin or system-read for readonly access.

We could introduce two new permissions

• ITEM_ROLE_ADMIN
• AGENT_ROLE_ADMIN

Change the jelly config pages to reflect the read-only vs read-write of the sections based upon the users permissions.

This would need changes to the two pages:

• Manage Roles
• Assign Roles

Use Case

An admin could specify global roles to provide respective *_ROLE_ADMIN permissions to the power-user. The power-user would currently need SYSTEM_READ at a minimum, but I see that as acceptable.

This allows a more secure way of managing job permissions.