Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-16273

Slaves forbidden to request JNLP anonymously but -jnlpCredentials not offered

    Details

    • Similar Issues:

      Description

      All of my windows salve cannot connect to Jenkins master after upgrading to 1.498. Following messages showed up in slaves' jenkins-slave.err:

      java.io.IOException: Failed to load http://192.168.30.95/jenkins/computer/Fortify%201/slave-agent.jnlp: 403 Forbidden
      at hudson.remoting.Launcher.parseJnlpArguments(Launcher.java:238)
      at hudson.remoting.Launcher.run(Launcher.java:200)
      at hudson.remoting.Launcher.main(Launcher.java:173)

        Attachments

          Issue Links

            Activity

            Hide
            jglick Jesse Glick added a comment -

            @nerdmachine there is no need to run without security; you just need to manually specify -jnlpCredentials user:apitoken in jenkins-slave.xml.

            The SECURITY project is indeed restricted. See https://wiki.jenkins-ci.org/display/JENKINS/Security+Advisories for information.

            Show
            jglick Jesse Glick added a comment - @nerdmachine there is no need to run without security; you just need to manually specify -jnlpCredentials user:apitoken in jenkins-slave.xml . The SECURITY project is indeed restricted. See https://wiki.jenkins-ci.org/display/JENKINS/Security+Advisories for information.
            Hide
            jglick Jesse Glick added a comment -

            Tested workaround for the combination of this and JENKINS-9679 in 1.480.2 for Windows service users on XP:

            1. Remove any existing service. (jenkins-slave.exe uninstall or see http://stackoverflow.com/a/197941/12916 for removing the service entry; and delete the slave directory.)
            2. From Windows slave machine, log in, browse to slave page, and click on the JNLP launch button; slave should start.
            3. Request Windows service installation.
            4. Stop service if you started it. (Control Panel » Admin Tools » Services)
            5. Copy your downloaded jenkins-slave.jnlp somewhere permanent, such as the slave FS root.
            6. Open jenkins-slave.xml in Notepad, find the -jnlpUrl, and change it to point to the downloaded JNLP. This will be a file-protocol URL and must use forward slashes like any URL, e.g.:
              -jnlpUrl file:/C:/jenkins/slave-agent.jnlp
            7. Start service. The slave should now be connected, and should reconnect properly after a reboot.
            Show
            jglick Jesse Glick added a comment - Tested workaround for the combination of this and JENKINS-9679 in 1.480.2 for Windows service users on XP: Remove any existing service. ( jenkins-slave.exe uninstall or see http://stackoverflow.com/a/197941/12916 for removing the service entry; and delete the slave directory.) From Windows slave machine, log in, browse to slave page, and click on the JNLP launch button; slave should start. Request Windows service installation. Stop service if you started it. (Control Panel » Admin Tools » Services) Copy your downloaded jenkins-slave.jnlp somewhere permanent, such as the slave FS root. Open jenkins-slave.xml in Notepad, find the -jnlpUrl , and change it to point to the downloaded JNLP. This will be a file -protocol URL and must use forward slashes like any URL, e.g.: -jnlpUrl file:/C:/jenkins/slave-agent.jnlp Start service. The slave should now be connected, and should reconnect properly after a reboot.
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Jesse Glick
            Path:
            changelog.html
            core/src/main/resources/hudson/slaves/JNLPLauncher/main.jelly
            http://jenkins-ci.org/commit/jenkins/17f0161e56dc2eb213415528061d8c8792694960
            Log:
            JENKINS-16273 Improved instructions for passing -jnlpCredentials.
            First, display instructions when the user has CONNECT, not necessarily ADMINISTER.
            Second, when anonymous users cannot CONNECT, show how to use -jnlpCredentials
            (and do not bother showing javaws, since it does not work in this case).(cherry picked from commit a1e709ddf0ca48b25ad07ee13a2fbdb0a6d97c0e)

            Conflicts:
            changelog.html

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: changelog.html core/src/main/resources/hudson/slaves/JNLPLauncher/main.jelly http://jenkins-ci.org/commit/jenkins/17f0161e56dc2eb213415528061d8c8792694960 Log: JENKINS-16273 Improved instructions for passing -jnlpCredentials. First, display instructions when the user has CONNECT, not necessarily ADMINISTER. Second, when anonymous users cannot CONNECT, show how to use -jnlpCredentials (and do not bother showing javaws, since it does not work in this case).(cherry picked from commit a1e709ddf0ca48b25ad07ee13a2fbdb0a6d97c0e) Conflicts: changelog.html
            Hide
            walterk82 Walter Kacynski added a comment -

            The new documentation is very helpful thank-you. I had no idea that you could use the user API key.

            Show
            walterk82 Walter Kacynski added a comment - The new documentation is very helpful thank-you. I had no idea that you could use the user API key.
            Hide
            jglick Jesse Glick added a comment -

            @walterk82—yes this was always a possibility. There is a further change (SECURITY-54) which would supersede this technique, and may make it into 1.480.3, but it is still pending review.

            Show
            jglick Jesse Glick added a comment - @walterk82—yes this was always a possibility. There is a further change (SECURITY-54) which would supersede this technique, and may make it into 1.480.3, but it is still pending review.

              People

              • Assignee:
                Unassigned
                Reporter:
                beta Pei-Tang Huang
              • Votes:
                14 Vote for this issue
                Watchers:
                26 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: