[JENKINS-18113] "user is missing Build permission" error in LTS - Jenkins JIRA

Details

Type: Bug
Status: Resolved (View Workflow)
Priority: Critical
Resolution: Cannot Reproduce
Component/s: core
Labels:
- access
- exception
- permissions
- stack
Environment:
1.509.1 running on Debian Linux with LDAP server for authentication.

Similar Issues:

Show

Description

We are facing a permission issue with the current LTS version of
jenkins. Our setup uses a single LDAP server for authentication. In one
of our matrix jobs I have enabled specific permissions for a single LDAP
user so that this user can administer the whole job. In the
configuration page this user is correctly recognized from LDAP (the
person icon is shown) and has got all permissions for that job. While
this user can actually open the preferences page for the job, saving
modifications to the configuration results in the error message:

"userxxx is missing the Build permissions"

This can be confirmed with exception messages in the log files:

May 24, 2013 5:28:24 AM winstone.Logger logInternal
INFO: While serving http://ourserver/view/macos/job/thejob/configSubmit: hudson.security.AccessDeniedException2: affected-user is missing the Build permission
May 24, 2013 5:28:26 AM winstone.Logger logInternal
SEVERE: Error while serving http://ourserver/view/macos/job/thejob/configSubmit
java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor2202.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:288)
at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:151)
at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:90)
at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:111)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:241)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:241)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:583)
at org.kohsuke.stapler.Stapler.service(Stapler.java:214)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:45)
at winstone.ServletConfiguration.execute(ServletConfiguration.java:248)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:333)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:376)
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:95)
at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:87)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:48)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:124)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:174)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:64)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:50)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:227)
at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Caused by: java.lang.Error: This page expects a form submission
at org.kohsuke.stapler.RequestImpl.getSubmittedForm(RequestImpl.java:768)
at hudson.model.Job.doConfigSubmit(Job.java:1059)
at hudson.model.AbstractProject.doConfigSubmit(AbstractProject.java:753)
... 69 more
May 24, 2013 5:28:26 AM org.kohsuke.stapler.compression.CompressionFilter reportException
WARNING: Untrapped servlet exception
javax.servlet.ServletException: java.lang.Error: This page expects a form submission
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:719)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:241)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
at org.kohsuke.stapler.MetaClass$6.doDispatch(MetaClass.java:241)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:770)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:583)
at org.kohsuke.stapler.Stapler.service(Stapler.java:214)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:45)
at winstone.ServletConfiguration.execute(ServletConfiguration.java:248)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:333)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:376)
at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:95)
at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:87)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:48)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:124)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)

at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:174)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at jenkins.security.ApiTokenFilter.doFilter(ApiTokenFilter.java:64)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:66)
at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:76)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:50)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:81)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:194)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:366)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:331)
at winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:227)
at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:441)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:303)
at java.util.concurrent.FutureTask.run(FutureTask.java:138)
at winstone.BoundedExecutorService$1.run(BoundedExecutorService.java:77)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Caused by: java.lang.Error: This page expects a form submission
at org.kohsuke.stapler.RequestImpl.getSubmittedForm(RequestImpl.java:768)
at hudson.model.Job.doConfigSubmit(Job.java:1059)
at hudson.model.AbstractProject.doConfigSubmit(AbstractProject.java:753)
at sun.reflect.GeneratedMethodAccessor2202.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:288)
at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:151)
at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:90)
at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:111)
at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:677)
... 60 more

Attachments

Activity

Ascending order - Click to sort in descending order

Hide

Permalink

jfigler added a comment - 2013-10-03 14:06

Any news on this issue? I believe we are experiencing this in 1.509.3.

Show

jfigler added a comment - 2013-10-03 14:06 Any news on this issue? I believe we are experiencing this in 1.509.3.

Hide

Permalink

Jeff Burke added a comment - 2014-01-23 00:54 - edited

I'm on 1.545 on Windows 7 sp1 and get the same error. I use the Active Directory Plugin for authentication and the Role-Based Strategy Plugin for authorization. I added a project role which grants all rights. When the user logs in, indeed, the user can see all the rights are active (Delete job appears and works, "Build" or "Build with Parameters" appears, etc). For non-parameterized jobs, "Build" works. For parameterized jobs, the "Build with Parameters" link shows, but when it renders, the response is 500 in the browser... a blank page appears... and in the Jenkins System Logs, the following message appears:

Jan 22, 2014 5:26:09 PM INFO org.eclipse.jetty.util.log.JavaUtilLog info
While serving http://g1build008/job/SC-Dev-Deploy/build: hudson.security.AccessDeniedException2: joebob is missing the Job/Build permission
Jan 22, 2014 5:26:09 PM WARNING org.eclipse.jetty.util.log.JavaUtilLog warn
header full: java.lang.RuntimeException: Header>6144

Now, I know the user has the permission Job/Build, because I can see that other jobs can be built by the user and if I remove the user from the project role, indeed, the other jobs can no longer be built by the user.

If I set the "Global permissions" in the Role-based authentication plugin... the user can view the "Build with parameters" page and run the build.

I don't know the details on how Jenkins manages permissions, but it would seem the global Job/Build permissions work for parameterized builds, but project-based Job/Build permissions fail.

Show

Jeff Burke added a comment - 2014-01-23 00:54 - edited I'm on 1.545 on Windows 7 sp1 and get the same error. I use the Active Directory Plugin for authentication and the Role-Based Strategy Plugin for authorization. I added a project role which grants all rights. When the user logs in, indeed, the user can see all the rights are active (Delete job appears and works, "Build" or "Build with Parameters" appears, etc). For non-parameterized jobs, "Build" works. For parameterized jobs, the "Build with Parameters" link shows, but when it renders, the response is 500 in the browser... a blank page appears... and in the Jenkins System Logs, the following message appears: Jan 22, 2014 5:26:09 PM INFO org.eclipse.jetty.util.log.JavaUtilLog info While serving http://g1build008/job/SC-Dev-Deploy/build: hudson.security.AccessDeniedException2: joebob is missing the Job/Build permission Jan 22, 2014 5:26:09 PM WARNING org.eclipse.jetty.util.log.JavaUtilLog warn header full: java.lang.RuntimeException: Header>6144 Now, I know the user has the permission Job/Build, because I can see that other jobs can be built by the user and if I remove the user from the project role, indeed, the other jobs can no longer be built by the user. If I set the "Global permissions" in the Role-based authentication plugin... the user can view the "Build with parameters" page and run the build. I don't know the details on how Jenkins manages permissions, but it would seem the global Job/Build permissions work for parameterized builds, but project-based Job/Build permissions fail.

Hide

Permalink

Daniel Beck added a comment - 2014-09-01 20:50

Does this issue still occur on recent (no older than eight weeks) versions of Jenkins? If so, please provide detailed and complete steps to reproduce the issue to aid further investigation.

Show

Daniel Beck added a comment - 2014-09-01 20:50 Does this issue still occur on recent (no older than eight weeks) versions of Jenkins? If so, please provide detailed and complete steps to reproduce the issue to aid further investigation.

Hide

Permalink

Johannes Wienke added a comment - 2014-09-01 20:57

I couldn't even remember this issue. So I suspect that this probably doesn't occur anymore, at least for us.

Show

Johannes Wienke added a comment - 2014-09-01 20:57 I couldn't even remember this issue. So I suspect that this probably doesn't occur anymore, at least for us.

Hide

Permalink

Daniel Beck added a comment - 2014-09-01 21:05

Resolving as reporter indicates this does not occur anymore.

Please just file a new issue if a similar issue occurs in recent (no older than eight weeks) versions of Jenkins.

Show

Daniel Beck added a comment - 2014-09-01 21:05 Resolving as reporter indicates this does not occur anymore. Please just file a new issue if a similar issue occurs in recent (no older than eight weeks) versions of Jenkins.

People

Assignee:

Unassigned

Reporter:

Johannes Wienke

Votes:

5 Vote for this issue

Watchers:

5 Start watching this issue

Dates

Created:

2013-05-28 13:33

Updated:

2014-09-01 21:05

Resolved:

2014-09-01 21:05