Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-11024

Some commands don't work when using _jenkins-cli.jar with -i switch, get-job and update-job for sure, not certain about others

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Cannot Reproduce
    • Component/s: cli
    • Labels:
      None
    • Environment:
      CLI

      Description

      Add keys for authenticated login. Works fine with who-am-i, enable-job, disable-job, delete-job, create-job, but get-job and update-job fail claiming there is no job by that name. The very same command line with enable-job (as well as the others) works fine.

      Workaround is to see if enable-job fails (which it will if there is no job by that name, which was the point of using get-job), then delete-job and create-job instead of update-job if the job already exists. Note that this workaround causes the loss of job history upon deletion.

      Diagnostics:

      % java -jar jenkins/_jenkins-cli.jar -s http://localhost:9090/ -i jenkins/id_rsa get-job trunk-pacman.integration.vdev-regression
      No such job 'trunk-pacman.integration.vdev-regression'
      java -jar jenkins-cli.jar get-job args...
      Dumps the job definition XML to stdout
      JOB : Name of the job
      --username VAL : User name to authenticate yourself to Jenkins
      --password VAL : Password for authentication. Note that passing a
      password in arguments is insecure.
      --password-file VAL : File that contains the password

      % java -jar jenkins/_jenkins-cli.jar -s http://localhost:9090/ -i jenkins/id_rsa enable-job trunk-pacman.integration.vdev-regression
      % echo $?
      0

        Activity

        Hide
        hicwic Steve Eckerlein added a comment -

        I accenditaly reproduce this issue at work.

        When using -i for ssh credential, build and some other command doesn't work for job who are not readable by annonymous. (enable-job work)

        The workaround is to activate "security based project" and to activate read access to anonymous user.

        It must be a visibility issue. CLI see only anonymous job, not jobs seen by account used with -i parameter. On other way, the build start when anonymous have not build rights. So it's only visibility issue.

        Show
        hicwic Steve Eckerlein added a comment - I accenditaly reproduce this issue at work. When using -i for ssh credential, build and some other command doesn't work for job who are not readable by annonymous. (enable-job work) The workaround is to activate "security based project" and to activate read access to anonymous user. It must be a visibility issue. CLI see only anonymous job, not jobs seen by account used with -i parameter. On other way, the build start when anonymous have not build rights. So it's only visibility issue.
        Hide
        sdaigle S Daigle added a comment -

        Is this issue ever going to be resolved? In companies like mine where adding anonymous read access is not an option, and relying on many of the CLI commands, an issue like this limits the things we can do with Jenkins jobs outside the UI. If anyone has a workaround to this, that would be welcome.

        Show
        sdaigle S Daigle added a comment - Is this issue ever going to be resolved? In companies like mine where adding anonymous read access is not an option, and relying on many of the CLI commands, an issue like this limits the things we can do with Jenkins jobs outside the UI. If anyone has a workaround to this, that would be welcome.
        Hide
        gouzi gouzi added a comment -

        The 'build' command does not work either, as the job name cannot be retrieved:
        $ java -jar jenkins-cli.jar -s http://localhost:8090 -i ~/.ssh/id_rsa build Project1

        No such job 'Project1'
        java -jar jenkins-cli.jar build args...
        Starts a build, and optionally waits for a completion.
        (...)

        And Project1 does exist!

        Show
        gouzi gouzi added a comment - The 'build' command does not work either, as the job name cannot be retrieved: $ java -jar jenkins-cli.jar -s http://localhost:8090 -i ~/.ssh/id_rsa build Project1 – No such job 'Project1' java -jar jenkins-cli.jar build args... Starts a build, and optionally waits for a completion. (...) – And Project1 does exist!
        Hide
        hicwic Steve Eckerlein added a comment -

        The build command work, but you have to give anonymous read access to your Project1. Then CLI command will see it.
        Must be a visibility issue...

        Show
        hicwic Steve Eckerlein added a comment - The build command work, but you have to give anonymous read access to your Project1. Then CLI command will see it. Must be a visibility issue...
        Hide
        kieranshaw Kieran Shaw added a comment -

        Agreed that this is an important issue, I don't want to give anonymous read access just to be able to use the CLI.

        Show
        kieranshaw Kieran Shaw added a comment - Agreed that this is an important issue, I don't want to give anonymous read access just to be able to use the CLI.
        Hide
        barrett Barrett Strausser added a comment -

        Same issue here.

        Show
        barrett Barrett Strausser added a comment - Same issue here.
        Hide
        gargii Jan Gargulák added a comment -

        Same here. Anonymous access is not acceptable. Looking for workaround.

        Show
        gargii Jan Gargulák added a comment - Same here. Anonymous access is not acceptable. Looking for workaround.
        Hide
        netropic Max Burdge added a comment -

        I would also like a solution or workaround for this issue.

        Show
        netropic Max Burdge added a comment - I would also like a solution or workaround for this issue.
        Hide
        drnic drnic added a comment - - edited

        Having the same issue with --username & --password authentication.

        Show
        drnic drnic added a comment - - edited Having the same issue with --username & --password authentication.
        Hide
        drnic drnic added a comment -

        Sad panda for the 1.5 year old ticket

        Show
        drnic drnic added a comment - Sad panda for the 1.5 year old ticket
        Hide
        drnic drnic added a comment -

        Confirming the workaround - I toggled the Job > Read checkbox for the anonymous user and I can now run builds via the CLI and anonymous users can not see anything when they visit the jenkins URL.

        Show
        drnic drnic added a comment - Confirming the workaround - I toggled the Job > Read checkbox for the anonymous user and I can now run builds via the CLI and anonymous users can not see anything when they visit the jenkins URL.
        Hide
        drnic drnic added a comment -

        I wrote up the use of the CLI and how to setup this workaround http://starkandwayne.com/articles/2013/04/12/jenkins-builds-from-cli/

        Show
        drnic drnic added a comment - I wrote up the use of the CLI and how to setup this workaround http://starkandwayne.com/articles/2013/04/12/jenkins-builds-from-cli/
        Hide
        hvamsik Vamsi Hari added a comment -

        wow, thanks a lot dr nic, it solved issues with jenkins-cli in our case,

        Show
        hvamsik Vamsi Hari added a comment - wow, thanks a lot dr nic, it solved issues with jenkins-cli in our case,
        Hide
        jglick Jesse Glick added a comment -

        JENKINS-12543 covers the problems with username/password authentication. I could not reproduce any problems in current trunk with SSH authentication.

        Show
        jglick Jesse Glick added a comment - JENKINS-12543 covers the problems with username/password authentication. I could not reproduce any problems in current trunk with SSH authentication.
        Hide
        swf Yves Schumann added a comment - - edited

        Im Using Jenkins-CLI to setup jobs based on an deactivated job template and modify the activation state of the created jobs in a second step. It seems that I run into this issue as the creation of new jobs works as expected but the activation fails:

        Calling jenkins api to create job 'eisfair__bcstorage' hudson.security.AccessDeniedException2: anonymous fehlt das Recht 'Job/Configure' 
         	at hudson.security.ACL.checkPermission(ACL.java:54)
         	at hudson.model.AbstractItem.checkPermission(AbstractItem.java:446)
         	...
        

        Why is there "anonymous" used? Username and password is the same as for job creation some milliseconds before!?

        Sad story as there are more than 500 jobs handled this way and it is absolutely annoying to do this by hand...

        Show
        swf Yves Schumann added a comment - - edited Im Using Jenkins-CLI to setup jobs based on an deactivated job template and modify the activation state of the created jobs in a second step. It seems that I run into this issue as the creation of new jobs works as expected but the activation fails: Calling jenkins api to create job 'eisfair__bcstorage' hudson.security.AccessDeniedException2: anonymous fehlt das Recht 'Job/Configure' at hudson.security.ACL.checkPermission(ACL.java:54) at hudson.model.AbstractItem.checkPermission(AbstractItem.java:446) ... Why is there "anonymous" used? Username and password is the same as for job creation some milliseconds before!? Sad story as there are more than 500 jobs handled this way and it is absolutely annoying to do this by hand...
        Hide
        danielbeck Daniel Beck added a comment -

        Cannot reproduce on 1.584. java -jar jenkins-cli.jar -i ~/.ssh/id_rsa -s http://myjenkins get-job foo returns the job's config.xml. Anonymous has no permissions on that instance.

        Anyone still experiencing this on recent Jenkins versions?

        Show
        danielbeck Daniel Beck added a comment - Cannot reproduce on 1.584. java -jar jenkins-cli.jar -i ~/.ssh/id_rsa -s http://myjenkins get-job foo returns the job's config.xml. Anonymous has no permissions on that instance. Anyone still experiencing this on recent Jenkins versions?
        Hide
        danielbeck Daniel Beck added a comment -

        No response to comment asking for updated information in over three months, so resolving as cannot Reproduce.

        Show
        danielbeck Daniel Beck added a comment - No response to comment asking for updated information in over three months, so resolving as cannot Reproduce.

          People

          • Assignee:
            Unassigned
            Reporter:
            tmeazell Timothy Meazell
          • Votes:
            13 Vote for this issue
            Watchers:
            17 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved: