Details

    • Similar Issues:
    • Released As:
      1.5

      Description

      We are running jenkins behind an apache proxy

      Since the latest update, the kerberos sso plugin will cause issues related to the CSRF security policy that is enabled by default.

       

      If we only disable the Kerberos SSO, and log in manually using LDAP credentials, everything works as expected.

      If we only disable the CSRF Protection, and login using SSO, everything works as expected

      (besides a remote API call, that requires CSRF to be enabled)

       

      But when both CSRF and SSO are enabled, the automatic login works perfectly.

      But the moment you try to do a form submit, like starting a job, we will get a 403 - Forbidden error.

      This has been working perfectly for a few years. So a recent update broke this.

      Perhaps the SSO plugin needs an update, related to another recent change in how CSRF is handled ?

        Attachments

          Issue Links

            Activity

            Hide
            kndx Koen Dierckx added a comment -

            https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+the+SECURITY-901+fix

            This is the cause, by adding the jenkins.security.seed.UserSeedProperty.disableUserSeed to true, everything works again.

            Hopefully this helps in updating the plugin

            Show
            kndx Koen Dierckx added a comment - https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+the+SECURITY-901+fix This is the cause, by adding the jenkins.security.seed.UserSeedProperty.disableUserSeed to true, everything works again. Hopefully this helps in updating the plugin
            Hide
            peter_nordquist Peter Nordquist added a comment -

            In my instance with kerberos-sso 1.2, the incompatibility with SECURITY-901 manifests as a redirect loop.  I've been unable to upgrade to 1.4 due to JENKINS-44484 but I'll test it on a separate instance.

            Show
            peter_nordquist Peter Nordquist added a comment - In my instance with kerberos-sso 1.2, the incompatibility with SECURITY-901 manifests as a redirect loop.  I've been unable to upgrade to 1.4 due to  JENKINS-44484 but I'll test it on a separate instance.
            Hide
            olivergondza Oliver Gondža added a comment -

            Thank you both for addressing this issue. I am getting the PR verification ready to test against affected Jenkins version in https://github.com/jenkinsci/kerberos-sso-plugin/pull/12

            Show
            olivergondza Oliver Gondža added a comment - Thank you both for addressing this issue. I am getting the PR verification ready to test against affected Jenkins version in https://github.com/jenkinsci/kerberos-sso-plugin/pull/12
            Hide
            olivergondza Oliver Gondža added a comment -

            I have merged the PR even though the tests against 1.150.2 are not passing yet. It is the only way for you to get the CI builds on never Jenkins version.

            Show
            olivergondza Oliver Gondža added a comment - I have merged the PR even though the tests against 1.150.2 are not passing yet. It is the only way for you to get the CI builds on never Jenkins version.
            Hide
            olivergondza Oliver Gondža added a comment -

            Fix released as 1.5

            Show
            olivergondza Oliver Gondža added a comment - Fix released as 1.5

              People

              • Assignee:
                peter_nordquist Peter Nordquist
                Reporter:
                kndx Koen Dierckx
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: