jenkinsci / jenkinsci/gitlab-plugin

GitLab plugin checks only global roles, project role is not verified

Open
#950 5 comments 1 reaction 0 assignees View on GitHub
Dominant language
Java
Stars
1.4k
Forks
615
Avg merge
4h 32m
Merged PRs (30d)
10

Description

#issue
Per plugin instruction document, I try to use userid+token for Jenkins job authentication:
https://github.com/jenkinsci/gitlab-plugin#gitlab-to-jenkins-authentication, and use Configuring global authentication.

First, I grant the user with job/Build permission to certain jobs, e.g. grant permission to a folder which has several jobs.
Second, I grant the user permission in global level, i.e. all jobs that has been assigned with job/Build permission.

After setting up above webhook in GitLab, and trigger the Job via GitLab, in the first scenario, the authentication is failed with code 403. and the second scenario is successful.

It seems GitLab plugin do not verify the folder level job/Build permission, instead, it checks only towards global job/Build permission.

### Context
- **Gitlab plugin version**: 1.5.12
- **Gitlab version**: 11.10.4
- **Jenkins version**: 2.176.1
- **Job type**: Pipeline

### Logs & Traces

Error 403 xyz_user is missing the Job/Build permission

HTTP ERROR 403


Problem accessing /project/CTO/DevOps/sandbox/demo/test-global-role. Reason:

    xyz_user is missing the Job/Build permission


Powered by Jetty:// 9.4.z-SNAPSHOT

in Jenkins log:
Jul 18, 2019 3:36:30 AM FINEST com.dabsquared.gitlabjenkins.webhook.build.BuildWebHookAction
Unauthorized (Did you forget to add API Token to the web hook ?)

### Problem description

_Describe your problem in a meaningful way_:
- what were you doing (simple push, merge request, MR with fork, ...)
Configure a Jenkins job webhook in gitlab in use global authentication way, i.e. with userid+API token+Jenkins Job URL. And trigger a push event from GitLab.
This userid has been assigned with Job/Build permission for certain folders in Jenkins.

- what was expected
The webhook is able to trigger Jenkins job.

- what occurred finally
The push event from GitLab is rejected with code 403, user is missing Job/Build permission.
When user assigned with global Job/Build permission, the Jenkins job can be triggered successfully.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.