[JENKINS-63170] Queue Item Authorization appears to not be propagated

I am currently experiencing an issue where queue item authentication appears to not be propagating properly.

Firstly, my Jenkins instance is set to run as user who triggered builds at the master level. Now, suppose I have two jobs: a pipeline job A whose Jenkinsfile has a build step that triggers freestyle job B.

Now, suppose a user with run access to both jobs triggers job A through the REST API, authenticating via an API token. Job B is triggered as normal, but in the log of Job B, I see the following:

Started by upstream project "A" build number 1

originally caused by:

 Started by remote host 

Running as SYSTEM 

This raises a red flag, since you'd expect that Job B would be running as the user that triggered Job A. Job A's log only states this:

Started by remote host  

Again, without reference to the name of the user that invoked the job through the API token, nor does it show a message something like "Running as user Alice" or somesuch.

As of this point, I am not aware of whether it is an issue with the Authorize Project plugin, or whether it is an issue elsewhere, but because job B is being run as SYSTEM, it is definitely not as intended. Please assist in this matter.

---
Originally reported by kchung_twitter, imported from: Queue Item Authorization appears to not be propagated

• status: Open
  
• priority: Minor
  
• component(s): authorize-project-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 20260312-112651
  

Raw content of original issue

I am currently experiencing an issue where queue item authentication appears to not be propagating properly.


Firstly, my Jenkins instance is set to run as user who triggered builds at the master level. Now, suppose I have two jobs: a pipeline job A whose Jenkinsfile has a build step that triggers freestyle job B.


Now, suppose a user with run access to both jobs triggers job A through the REST API, authenticating via an API token. Job B is triggered as normal, but in the log of Job B, I see the following:



Started by upstream project "A" build number 1

originally caused by:

 Started by remote host <REDACTED>

Running as SYSTEM 



This raises a red flag, since you'd expect that Job B would be running as the user that triggered Job A. Job A's log only states this:



Started by remote host <REDACTED> 



Again, without reference to the name of the user that invoked the job through the API token, nor does it show a message something like "Running as user Alice" or somesuch.


As of this point, I am not aware of whether it is an issue with the Authorize Project plugin, or whether it is an issue elsewhere, but because job B is being run as SYSTEM, it is definitely not as intended. Please assist in this matter.

Start by reproducing the reported flow: trigger pipeline job A through the REST API with an API token, then have its build step trigger freestyle job B. Inspect both build logs and the authorize-project-plugin behavior around queue-item authorization. Done means the triggering user's identity is propagated to job B instead of it running as SYSTEM, with the logs reflecting that identity.

Written by the indexing model from the issue text.