[JENKINS-8925] Cannot use CLI when using OpenID

Type: Bug
Resolution: Fixed
Priority: Major
Component/s: openid-plugin
Labels:
None
Environment:
Fedora 14 x86_64
Google OpenID provider

Similar Issues:
Powered by SuggestiMate

Show

I've configured Jenkins to use Google's OpenID provider in conjunction with matrix-based security, and I cannot log in using the CLI:

$ jenkins-cli --username xxx@xxx.com --password xxx
Exception in thread "main" java.io.IOException: Server returned HTTP response code: 403 for URL: http://localhost:8080/cli
	at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1403)
	at hudson.cli.FullDuplexHttpStream.<init>(FullDuplexHttpStream.java:61)
	at hudson.cli.CLI.<init>(CLI.java:91)
	at hudson.cli.CLI.<init>(CLI.java:63)
	at hudson.cli.CLI.main(CLI.java:176)

Bryan O'Sullivan created issue - 2011-03-02 05:01

Bryan O'Sullivan made changes - 2011-03-02 05:03

Description

Original: I've configured Jenkins to use Google's OpenID provider in conjunction with matrix-based security, and I cannot log in using the CLI:

{{
$ jenkins-cli --username xxx@xxx.com --password xxx
Exception in thread "main" java.io.IOException: Server returned HTTP response code: 403 for URL: http://localhost:8080/cli
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1403)
at hudson.cli.FullDuplexHttpStream.<init>(FullDuplexHttpStream.java:61)
at hudson.cli.CLI.<init>(CLI.java:91)
at hudson.cli.CLI.<init>(CLI.java:63)
at hudson.cli.CLI.main(CLI.java:176)
}}

New: I've configured Jenkins to use Google's OpenID provider in conjunction with matrix-based security, and I cannot log in using the CLI:

{noformat}
$ jenkins-cli --username xxx@xxx.com --password xxx
Exception in thread "main" java.io.IOException: Server returned HTTP response code: 403 for URL: http://localhost:8080/cli
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1403)
at hudson.cli.FullDuplexHttpStream.<init>(FullDuplexHttpStream.java:61)
at hudson.cli.CLI.<init>(CLI.java:91)
at hudson.cli.CLI.<init>(CLI.java:63)
at hudson.cli.CLI.main(CLI.java:176)
{noformat}

Bryan O'Sullivan made changes - 2011-03-02 05:03

Summary

Original: Cannot use CLI to log in when using OpenID

New: Cannot use CLI when using OpenID

Bryan O'Sullivan added a comment - 2011-03-02 05:06

Oh, and I see this in jenkins.log:

WARNING: No valid crumb was included in request for /cli.  Returning 403.
Mar 2, 2011 12:03:58 AM hudson.security.csrf.CrumbFilter doFilter

Bryan O'Sullivan added a comment - 2011-03-02 05:06 Oh, and I see this in jenkins.log : WARNING: No valid crumb was included in request for /cli. Returning 403. Mar 2, 2011 12:03:58 AM hudson.security.csrf.CrumbFilter doFilter

Bryan O'Sullivan added a comment - 2011-03-02 05:10 - edited

With CSRF detection turned off, I now get this on the client side:

$ jenkins-cli login --username xxx@xxx.com --password xxx
"--username" is not a valid option

And on the server (yes, the UUID below is anonymized):

SEVERE: I/O error in channel HTTP full-duplex channel 12341234-1234-1234-1234-123412341234
java.io.IOException: chunked stream ended unexpectedly
        at hudson.util.ChunkedInputStream.getChunkSizeFromInputStream(ChunkedInputStream.java:225)
        at hudson.util.ChunkedInputStream.nextChunk(ChunkedInputStream.java:197)
        at hudson.util.ChunkedInputStream.read(ChunkedInputStream.java:120)
        at java.io.ObjectInputStream$PeekInputStream.peek(ObjectInputStream.java:2265)
        at java.io.ObjectInputStream$BlockDataInputStream.peek(ObjectInputStream.java:2558)
        at java.io.ObjectInputStream$BlockDataInputStream.peekByte(ObjectInputStream.java:2568)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1314)
        at java.io.ObjectInputStream.readObject(ObjectInputStream.java:368)
        at hudson.remoting.Channel$ReaderThread.run(Channel.java:974)

Bryan O'Sullivan added a comment - 2011-03-02 05:10 - edited With CSRF detection turned off, I now get this on the client side: $ jenkins-cli login --username xxx@xxx.com --password xxx "--username" is not a valid option And on the server (yes, the UUID below is anonymized): SEVERE: I/O error in channel HTTP full-duplex channel 12341234-1234-1234-1234-123412341234 java.io.IOException: chunked stream ended unexpectedly at hudson.util.ChunkedInputStream.getChunkSizeFromInputStream(ChunkedInputStream.java:225) at hudson.util.ChunkedInputStream.nextChunk(ChunkedInputStream.java:197) at hudson.util.ChunkedInputStream.read(ChunkedInputStream.java:120) at java.io.ObjectInputStream$PeekInputStream.peek(ObjectInputStream.java:2265) at java.io.ObjectInputStream$BlockDataInputStream.peek(ObjectInputStream.java:2558) at java.io.ObjectInputStream$BlockDataInputStream.peekByte(ObjectInputStream.java:2568) at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1314) at java.io.ObjectInputStream.readObject(ObjectInputStream.java:368) at hudson.remoting.Channel$ReaderThread.run(Channel.java:974)

Kohsuke Kawaguchi added a comment - 2011-03-27 22:10

I guess the fundamental question is how do I authenticate the user when you use OpenID in the SSO mode. This is not an HTTP client, so it cannot go through the OpenID protocol.

I guess I need some kind of API key/secret key stuff or PKI.

Kohsuke Kawaguchi added a comment - 2011-03-27 22:10 I guess the fundamental question is how do I authenticate the user when you use OpenID in the SSO mode. This is not an HTTP client, so it cannot go through the OpenID protocol. I guess I need some kind of API key/secret key stuff or PKI.

Monty Taylor added a comment - 2011-12-11 22:50

Was chatting briefly with kohsuke on email the other day - just wanted to drop a note here so that the bug would be noticed.

Monty Taylor added a comment - 2011-12-11 22:50 Was chatting briefly with kohsuke on email the other day - just wanted to drop a note here so that the bug would be noticed.

Monty Taylor added a comment - 2012-02-27 23:59

This now works, actually. If you log in as a user via openid, it creates an auth token for that user which can be used in subsequent requests.

Monty Taylor added a comment - 2012-02-27 23:59 This now works, actually. If you log in as a user via openid, it creates an auth token for that user which can be used in subsequent requests.

Monty Taylor made changes - 2012-02-27 23:59

Resolution		New: Fixed [ 1 ]
Status	Original: Open [ 1 ]	New: Closed [ 6 ]

Rafael Fonseca added a comment - 2013-12-17 02:02

Can you clarify how you are logging in using the CLI? I can't get it to work. It does pick the right username based on my SSH key, though.

java -jar jenkins-cli.jar -s http://jenkins_url:8080/ login 
hudson.security.UserMayOrMayNotExistException: Unable to query user information: my_username
	at hudson.security.UserDetailsServiceProxy.loadUserByUsername(UserDetailsServiceProxy.java:43)
	at hudson.security.SecurityRealm.loadUserByUsername(SecurityRealm.java:305)
	at hudson.cli.ClientAuthenticationCache.set(ClientAuthenticationCache.java:90)
	at hudson.cli.LoginCommand.run(LoginCommand.java:37)
	at hudson.cli.CLICommand.main(CLICommand.java:232)
	at hudson.cli.CliManagerImpl.main(CliManagerImpl.java:92)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:606)
	at hudson.remoting.RemoteInvocationHandler$RPCRequest.perform(RemoteInvocationHandler.java:299)
	at hudson.remoting.RemoteInvocationHandler$RPCRequest.call(RemoteInvocationHandler.java:280)
	at hudson.remoting.RemoteInvocationHandler$RPCRequest.call(RemoteInvocationHandler.java:239)
	at hudson.remoting.UserRequest.perform(UserRequest.java:118)
	at hudson.remoting.UserRequest.perform(UserRequest.java:48)
	at hudson.remoting.Request$2.run(Request.java:328)
	at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72)
	at hudson.cli.CliManagerImpl$1.call(CliManagerImpl.java:63)
	at hudson.remoting.InterceptingExecutorService$2.call(InterceptingExecutorService.java:95)
	at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
	at java.util.concurrent.FutureTask.run(FutureTask.java:166)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at java.lang.Thread.run(Thread.java:724)

Rafael Fonseca added a comment - 2013-12-17 02:02 Can you clarify how you are logging in using the CLI? I can't get it to work. It does pick the right username based on my SSH key, though. java -jar jenkins-cli.jar -s http://jenkins_url:8080/ login hudson.security.UserMayOrMayNotExistException: Unable to query user information: my_username at hudson.security.UserDetailsServiceProxy.loadUserByUsername(UserDetailsServiceProxy.java:43) at hudson.security.SecurityRealm.loadUserByUsername(SecurityRealm.java:305) at hudson.cli.ClientAuthenticationCache.set(ClientAuthenticationCache.java:90) at hudson.cli.LoginCommand.run(LoginCommand.java:37) at hudson.cli.CLICommand.main(CLICommand.java:232) at hudson.cli.CliManagerImpl.main(CliManagerImpl.java:92) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at hudson.remoting.RemoteInvocationHandler$RPCRequest.perform(RemoteInvocationHandler.java:299) at hudson.remoting.RemoteInvocationHandler$RPCRequest.call(RemoteInvocationHandler.java:280) at hudson.remoting.RemoteInvocationHandler$RPCRequest.call(RemoteInvocationHandler.java:239) at hudson.remoting.UserRequest.perform(UserRequest.java:118) at hudson.remoting.UserRequest.perform(UserRequest.java:48) at hudson.remoting.Request$2.run(Request.java:328) at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72) at hudson.cli.CliManagerImpl$1.call(CliManagerImpl.java:63) at hudson.remoting.InterceptingExecutorService$2.call(InterceptingExecutorService.java:95) at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334) at java.util.concurrent.FutureTask.run(FutureTask.java:166) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) at java.lang.Thread.run(Thread.java:724)

Assignee:: Unassigned

Reporter:: Bryan O'Sullivan

Votes:: 2 Vote for this issue

Watchers:: 3 Start watching this issue

Created:: 2011-03-02 05:01

Updated:: 2013-12-17 02:02

Resolved:: 2012-02-27 23:59

Jenkins

Details

Description

Attachments

Activity

Collapse comment: Bryan O'Sullivan added a comment - 2011-03-02 05:06

Expand comment: Bryan O'Sullivan added a comment - 2011-03-02 05:06

Collapse comment: Bryan O'Sullivan added a comment - 2011-03-02 05:10, Edited by Bryan O'Sullivan - 2011-03-02 05:10

Expand comment: Bryan O'Sullivan added a comment - 2011-03-02 05:10, Edited by Bryan O'Sullivan - 2011-03-02 05:10

Collapse comment: Kohsuke Kawaguchi added a comment - 2011-03-27 22:10

Expand comment: Kohsuke Kawaguchi added a comment - 2011-03-27 22:10

Collapse comment: Monty Taylor added a comment - 2011-12-11 22:50

Expand comment: Monty Taylor added a comment - 2011-12-11 22:50

Collapse comment: Monty Taylor added a comment - 2012-02-27 23:59

Expand comment: Monty Taylor added a comment - 2012-02-27 23:59

Collapse comment: Rafael Fonseca added a comment - 2013-12-17 02:02

Expand comment: Rafael Fonseca added a comment - 2013-12-17 02:02

People

Dates