[JENKINS-72727] Odd Interaction with SSH Build Agents plugin

I'm in the process of setting up agent roles with the role-based authorization strategy plugin.

I set up the agent role below and assigned it to a user:

A user given this role should be able to configure agents matching the specified pattern. The user is also given the following through global roles:

The user is able to modify the jk-stg-stba-01 agent's configuration, but if the "Launch agents via SSH" launch method is selected, an access denied message is shown:

Even though this message is displayed, the user's still able to modify the agent's configuration.

This message is not displayed for admin users.

I've replicated this bug in a fresh Jenkins instance, only installing the recommended plugins + role-based authorization and SSH Build Agents.

Would it be possible for someone to look into this?

Cheers

---
Originally reported by jsdemers, imported from: Odd Interaction with SSH Build Agents plugin

• assignee: mawinter69
  
• status: In Progress
  
• priority: Minor
  
• component(s): credentials-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 3
  
• imported: 2025-12-08
  

Raw content of original issue

I'm in the process of setting up agent roles with the role-based authorization strategy plugin.


I set up the agent role below and assigned it to a user:




A user given this role should be able to configure agents matching the specified pattern. The user is also given the following through global roles:




The user is able to modify the jk-stg-stba-01 agent's configuration, but if the "Launch agents via SSH" launch method is selected, an access denied message is shown:




Even though this message is displayed, the user's still able to modify the agent's configuration.


This message is not displayed for admin users.


I've replicated this bug in a fresh Jenkins instance, only installing the recommended plugins + role-based authorization and SSH Build Agents.


Would it be possible for someone to look into this?


Cheers

• environment: Jenkins version: 2.414.2, Role-based plugin version: 689.v731678c3e0eb_, SSH Build Agents plugin version: 2.948.vb_8050d697fec

3 attachments

- [image-2024-02-16-16-38-44-984.png](https://issues.jenkins.io/secure/attachment/62108/image-2024-02-16-16-38-44-984.png)
> 
- [image-2024-02-16-16-39-42-979.png](https://issues.jenkins.io/secure/attachment/62107/image-2024-02-16-16-39-42-979.png)
> 
- [image-2024-02-16-16-42-15-432.png](https://issues.jenkins.io/secure/attachment/62106/image-2024-02-16-16-42-15-432.png)
> 

Start by reproducing the reported setup with the role-based authorization and SSH Build Agents plugins on a fresh Jenkins instance, using the agent configuration and “Launch agents via SSH” path described in the issue. Done means the permission behavior is consistent: an authorized user can configure the matching agent without an erroneous access-denied message, or the actual authorization limitation is clearly enforced.

Written by the indexing model from the issue text.