Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-46540

"Open Blue Ocean" button disappers when "Block inheritance of global authorization matrix" is set in a folder

    XMLWordPrintable

    Details

    • Similar Issues:

      Description

      We create a root folder and activate the "Enable project-based security".

      "Open Blue Ocean" button is available at the root of our jenkins, but it disappears
      when you're in that folder where "Block inheritance of global authorization matrix" is set.

        Attachments

          Issue Links

            Activity

            Hide
            danielbeck Daniel Beck added a comment - - edited

            Does this issue still occur in Matrix Auth Plugin 2.1 or newer with the revised options for permissions inheritance?

            Show
            danielbeck Daniel Beck added a comment - - edited Does this issue still occur in Matrix Auth Plugin 2.1 or newer with the revised options for permissions inheritance?
            Hide
            danielbeck Daniel Beck added a comment -

            I was able to reproduce this problem and have found the cause. I consider this to be a bug in Blue Ocean: It checks the Overall/Read permission no matter in which context (folder, job, etc.) the sidepanel link would be displayed.

            https://github.com/jenkinsci/blueocean-plugin/blob/77960a8dc21840ae5f6df784a26f91e09d7da621/blueocean-rest-impl/src/main/resources/io/jenkins/blueocean/service/embedded/BlueOceanUrlAction/action.jelly#L8

            Global permissions are expected to not matter in the context of a folder, so the combination of not being able to grant them on a folder level, and not inheriting them from the global ACL, results in this permission check to fail if and only if you're in such a folder (or job – the same applies to jobs that don't inherit permissions).

            While an argument could be made that Matrix Auth should always inherit Overall/Read (the same way Overall/Administer is – since Matrix Auth 2.0 – always inherited) for compatibility with buggy plugins, this is ultimately, IMO, a Blue Ocean bug.

            Show
            danielbeck Daniel Beck added a comment - I was able to reproduce this problem and have found the cause. I consider this to be a bug in Blue Ocean: It checks the Overall/Read permission no matter in which context (folder, job, etc.) the sidepanel link would be displayed. https://github.com/jenkinsci/blueocean-plugin/blob/77960a8dc21840ae5f6df784a26f91e09d7da621/blueocean-rest-impl/src/main/resources/io/jenkins/blueocean/service/embedded/BlueOceanUrlAction/action.jelly#L8 Global permissions are expected to not matter in the context of a folder, so the combination of not being able to grant them on a folder level, and not inheriting them from the global ACL, results in this permission check to fail if and only if you're in such a folder (or job – the same applies to jobs that don't inherit permissions). While an argument could be made that Matrix Auth should always inherit Overall/Read (the same way Overall/Administer is – since Matrix Auth 2.0 – always inherited) for compatibility with buggy plugins, this is ultimately, IMO, a Blue Ocean bug.
            Hide
            danielbeck Daniel Beck added a comment -

            FWIW the permission check here makes no sense anyway, as the link would not be displayed to anyone without Overall/Read permission. It only governs whether they can see the link, not whether they can get access.

            Remove the linked line in the Jelly file and you're done. Someone up for some easy karma?

            Show
            danielbeck Daniel Beck added a comment - FWIW the permission check here makes no sense anyway, as the link would not be displayed to anyone without Overall/Read permission. It only governs whether they can see the link, not whether they can get access. Remove the linked line in the Jelly file and you're done. Someone up for some easy karma?
            Hide
            jglick Jesse Glick added a comment -

            You need Overall/Read to do anything except use an UnprotectedRootAction, so explicitly checking it makes little sense. Anyway, I am not sure why matrix-auth would be blocking inheritance of Overall/* permissions, but it should not matter since they should only ever be checked on Jenkins to begin with. (I used to want to actually enforce PermissionScope at runtime, but there are some corner cases that would be tricky to fix compatibly.) So agreed that just removing that line from action.jelly should suffice.

            Show
            jglick Jesse Glick added a comment - You need Overall/Read to do anything except use an UnprotectedRootAction , so explicitly checking it makes little sense. Anyway, I am not sure why matrix-auth would be blocking inheritance of Overall/* permissions, but it should not matter since they should only ever be checked on Jenkins to begin with. (I used to want to actually enforce PermissionScope at runtime, but there are some corner cases that would be tricky to fix compatibly.) So agreed that just removing that line from action.jelly should suffice.
            Hide
            danielbeck Daniel Beck added a comment -
            Show
            danielbeck Daniel Beck added a comment - FYI I asked about this in https://groups.google.com/d/msg/jenkinsci-dev/kg4UVxJ4gQQ/os-aPg85CAAJ

              People

              • Assignee:
                Unassigned
                Reporter:
                thitho_007 Thierry Tholle
              • Votes:
                0 Vote for this issue
                Watchers:
                7 Start watching this issue

                Dates

                • Created:
                  Updated: