Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-22949

QueueItemAuthenticator fallback behavior cleanup

    Details

    • Similar Issues:

      Description

      Currently Queue.Item.authenticate and Tasks.getAuthenticationOf check any configured QueueItemAuthenticator instances for a specific answer, then fall back to Queue.Task.getDefaultAuthentication, which for compatibility is normally SYSTEM. This behavior makes sense if there are no configured authenticators (the default case), or if there is an authenticator which returns a non-null authentication for every task.

      The problematic case is when there is a configured authenticator yet it returns null for the given task or item. This could happen if for example ProjectQueueItemAuthenticator were configured yet a user created a new job and did not add a AuthorizeProjectProperty. Now the job runs as SYSTEM, with full privileges, whereas we would really want it to run as ANONYMOUS, with no special privileges.

      BuildTrigger and ReverseBuildTrigger already specially handle this case by substituting ANONYMOUS for SYSTEM while they run (and in the former case printing a warning to the build console). But this does not extend to other plugin or core access control checks.

      In particular, Computer.BUILD is checked in two places (on Item) when deciding whether to build a job on a particular slave. You would expect to be able to control access to sensitive slaves by selectively granting BUILD only to certain people, and then requiring them to associate themselves with jobs they wish to build on those slaves. But this scheme cannot work if they can simply omit any authentication on the job and still have the build be authorized. (Jenkins Enterprise by CloudBees has a feature using a different scheme for the same use case.)

      It would be better if the callers of QueueItemAuthenticator.authenticate fell back to getDefaultAuthentication but replaced SYSTEM with ANONYMOUS in case there were at least one authenticator consulted. Then the replacement of SYSTEM with ANONYMOUS could be removed from both BuildTrigger and ReverseBuildTrigger. BuildTrigger.warning_you_have_no_plugins_providing_ac and BuildTrigger.warning_access_control_for_builds_in_glo could be left as is, or made more generic and moved into Run.execute; BuildTrigger.warning_this_build_has_no_associated_aut should be made more generic and moved into Run.execute (and Run.running_as_ printed with anonymous).

        Attachments

          Issue Links

            Activity

            jglick Jesse Glick created issue -
            jglick Jesse Glick made changes -
            Field Original Value New Value
            Link This issue is blocking JENKINS-16956 [ JENKINS-16956 ]
            jglick Jesse Glick made changes -
            Link This issue is blocking JENKINS-18285 [ JENKINS-18285 ]
            jglick Jesse Glick made changes -
            Link This issue is blocking JENKINS-22460 [ JENKINS-22460 ]
            jglick Jesse Glick made changes -
            Link This issue is related to JENKINS-26393 [ JENKINS-26393 ]
            jglick Jesse Glick made changes -
            Link This issue is related to JENKINS-30574 [ JENKINS-30574 ]
            oleg_nenashev Oleg Nenashev made changes -
            Comment [ Or Jenkins 2.0 ... ]
            jglick Jesse Glick made changes -
            Labels permissions security 2.0 permissions security
            ikedam ikedam made changes -
            Link This issue is related to JENKINS-32770 [ JENKINS-32770 ]
            kohsuke Kohsuke Kawaguchi made changes -
            Labels 2.0 permissions security permissions security
            danielbeck Daniel Beck made changes -
            Labels permissions security 2.0-rejected permissions security
            stephenconnolly Stephen Connolly made changes -
            Attachment jenkins-22949-config.png [ 32740 ]
            stephenconnolly Stephen Connolly made changes -
            Link This issue is duplicated by JENKINS-30574 [ JENKINS-30574 ]
            stephenconnolly Stephen Connolly made changes -
            Status Open [ 1 ] Closed [ 6 ]
            Resolution Won't Do [ 10001 ]
            rtyler R. Tyler Croy made changes -
            Workflow JNJira [ 155097 ] JNJira + In-Review [ 207695 ]
            jglick Jesse Glick made changes -
            Resolution Won't Do [ 10001 ]
            Status Closed [ 6 ] Reopened [ 4 ]
            Assignee Jesse Glick [ jglick ]
            jglick Jesse Glick made changes -
            Summary If a QueueItemAuthenticator is configured but returns null, use ANONYMOUS not SYSTEM QueueItemAuthenticator fallback behavior cleanup
            jglick Jesse Glick made changes -
            Status Reopened [ 4 ] Open [ 1 ]
            jglick Jesse Glick made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            jglick Jesse Glick made changes -
            Issue Type Bug [ 1 ] Task [ 3 ]
            jglick Jesse Glick made changes -
            Link This issue relates to JENKINS-24513 [ JENKINS-24513 ]
            jglick Jesse Glick made changes -
            Remote Link This issue links to "PR 2881 (Web Link)" [ 16503 ]
            jglick Jesse Glick made changes -
            Status In Progress [ 3 ] In Review [ 10005 ]
            jglick Jesse Glick made changes -
            Status In Review [ 10005 ] Resolved [ 5 ]
            Resolution Fixed [ 1 ]
            jglick Jesse Glick made changes -
            Status Resolved [ 5 ] In Review [ 10005 ]
            jglick Jesse Glick made changes -
            Status In Review [ 10005 ] Resolved [ 5 ]
            cloudbees CloudBees Inc. made changes -
            Remote Link This issue links to "CloudBees Internal OSS-934 (Web Link)" [ 18801 ]
            cleclerc Cyrille Le Clerc made changes -
            Link This issue causes JENKINS-58784 [ JENKINS-58784 ]

              People

              • Assignee:
                jglick Jesse Glick
                Reporter:
                jglick Jesse Glick
              • Votes:
                1 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: