jenkinsci / jenkinsci/gitlab-plugin
GitLab plugin checks only global roles, project role is not verified
- Dominant language
- Java
- Stars
- 1.4k
- Forks
- 615
- Avg merge
- 4h 32m
- Merged PRs (30d)
- 10
Description
#issue
Per plugin instruction document, I try to use userid+token for Jenkins job authentication:
https://github.com/jenkinsci/gitlab-plugin#gitlab-to-jenkins-authentication, and use Configuring global authentication.
First, I grant the user with job/Build permission to certain jobs, e.g. grant permission to a folder which has several jobs.
Second, I grant the user permission in global level, i.e. all jobs that has been assigned with job/Build permission.
After setting up above webhook in GitLab, and trigger the Job via GitLab, in the first scenario, the authentication is failed with code 403. and the second scenario is successful.
It seems GitLab plugin do not verify the folder level job/Build permission, instead, it checks only towards global job/Build permission.
### Context
- **Gitlab plugin version**: 1.5.12
- **Gitlab version**: 11.10.4
- **Jenkins version**: 2.176.1
- **Job type**: Pipeline
### Logs & Traces
Error 403 xyz_user is missing the Job/Build permission
HTTP ERROR 403
Problem accessing /project/CTO/DevOps/sandbox/demo/test-global-role. Reason:
xyz_user is missing the Job/Build permission
Powered by Jetty:// 9.4.z-SNAPSHOT
in Jenkins log:
Jul 18, 2019 3:36:30 AM FINEST com.dabsquared.gitlabjenkins.webhook.build.BuildWebHookAction
Unauthorized (Did you forget to add API Token to the web hook ?)
### Problem description
_Describe your problem in a meaningful way_:
- what were you doing (simple push, merge request, MR with fork, ...)
Configure a Jenkins job webhook in gitlab in use global authentication way, i.e. with userid+API token+Jenkins Job URL. And trigger a push event from GitLab.
This userid has been assigned with Job/Build permission for certain folders in Jenkins.
- what was expected
The webhook is able to trigger Jenkins job.
- what occurred finally
The push event from GitLab is rejected with code 403, user is missing Job/Build permission.
When user assigned with global Job/Build permission, the Jenkins job can be triggered successfully.
Contributor guide
Assessment
This issue has not been assessed yet.