Re: Users unable to build projects they're authorized for via role-strategy-plugin

[Richard Bywater]

I've had this issue in the part. In my experience there isn't really much
that you can do about it except to try and get people to use a particular
case when logging in (e.g. all lower case).

If there's an alternative option that can be chosen would love to hear
about it though.

Richard.

On Sat, 19 Jan 2019, 5:38 AM Benjamin Primrose,  wrote:

> I’m not sure if this is FYI or a plea for helpJ  TL:DR,
> role-strategy-plugin evaluates user permissions by case-sensitively
> comparing the username as entered in Assign Roles with the way they typed
> their name when *logging in*.
>
>
>
>
>
> Running:
>
>
>
>Jenkins 2.150.2 on windows server 2016
>
> Active Directory plugin 2.10 (this may be incidental info)
>
> Role-based Authorization Strategy 2.9.0
>
>
>
>
>
> What’s happening:
>
>
>
> I’m configuring a set of users with access.  Adding the users to
> project roles in “Manage Jenkins”->”Manage and Assign Roles”->”Assign
> Roles” works wonderfully.  More importantly, it is **case insensitive**.
> User’s logons at this org have the initial letter of first and last name
> capitalized in active directory, but no matter what case they’re entered in
> here the lookup in AD succeeds.
>
>
>
> The issue occurred when those users attempt to build the projects
> they’re authorized for—they can’t.  I have a secondary account of my own,
> which I added in the same way as the other users.  It could build projects,
> so I know my project role regex is OK.  The one other user who did work I’d
> lazily entered in all lower case instead of in the local “official”
> mixed-case format.  We went through the AD config for that user to figure
> out which field had their username in all lower case, but none did.  After
> some talking in circles, most users are entering their username in all
> lower case when logging in.  It appears the role-strategy-plugin compares
> the username logged in with **as typed** against the username entered in
> the Assign Roles config screen **as typed**.
>
>
>
>
>
> I had expected either the Assign Roles screen and logging in to do a
> lookup against AD, and store the actual username.  The actual behavior is
> very finicky, and some users do enter their username in mixed case.  Does
> anyone have a fix or workaround for this?
>
>
>
>
>
> Benjamin Primrose
> Principal Developer
> • Fitchburg, MA 01420
>
> Ph:978-353-8054 • bprimr...@wcu.com
>
>
>
>
>
> *Confidentiality Notice:  The materials in this electronic mail
> transmission (including attachments) are private and confidential and are
> the property of the sender and Workers Credit Union.  Unless stated to the
> contrary, any opinions or comments are personal to the writer and do not
> represent the official view of Workers Credit Union.  If you are not the
> intended recipient, you are hereby notified that any use, dissemination,
> disclosure or copying of this communication is strictly prohibited.  If you
> have received this communication in error, please destroy all copies of
> this message and its attachments and notify us immediately.  Thank you.*
>
>
>
> --
> You received this message because you are subscribed to the Google Groups
> "Jenkins Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to jenkinsci-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-users/5c4200fc.1c69fb81.a63cb.3fdaSMTPIN_ADDED_MISSING%40gmr-mx.google.com
> 
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-users/CAAy0hwei9hQB1NqPuBg8XtJo%2BA_vbgsNxHeoYsOPvfHkk0mQng%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: Logins (CAS plugin) not working after upgrading to 2.160 (security)

[Daniel Beck]

We documented this issue and a workaround at 
https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+the+SECURITY-901+fix

> On 17. Jan 2019, at 16:32, matthew.web...@diamond.ac.uk wrote:
> 
> I just upgraded Jenkins from 2.159 to 2.160, and then found that I could not 
> log on to the web interface.
> 
> Clicking "login" prompted me for my credentials as expected, and then 
> returned me to the Jenkins web page, but not logged in.
> Clearing cookies and cache, and using a different browser, did not fix the 
> problem.
> Our Jenkins is using the CAS plugin for user authentication.
> 
> I _was_ able to successfully authenticate to Jenkins using the 
> jenkins-cli.jar with an API token that I have previously set up.
> 
> Has anyone else seen this? I presume that if logons were generally broken in 
> that release, someone would have reported it by now.
> 
> I immediately rolled back to 2.159, and logon then started working.
> 
> Matthew
> 
> 
> -- 
> This e-mail and any attachments may contain confidential, copyright and or 
> privileged material, and are for the use of the intended addressee only. If 
> you are not the intended addressee or an authorised recipient of the 
> addressee please notify us of receipt by returning the e-mail and do not use, 
> copy, retain, distribute or disclose the information in or attached to the 
> e-mail.
> Any opinions expressed within this e-mail are those of the individual and not 
> necessarily of Diamond Light Source Ltd. 
> Diamond Light Source Ltd. cannot guarantee that this e-mail or any 
> attachments are free from viruses and we cannot accept liability for any 
> damage which you may sustain as a result of software viruses which may be 
> transmitted in or with the message.
> Diamond Light Source Limited (company no. 4375679). Registered in England and 
> Wales with its registered office at Diamond House, Harwell Science and 
> Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom
> 
> -- 
> You received this message because you are subscribed to the Google Groups 
> "Jenkins Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an 
> email to jenkinsci-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit 
> https://groups.google.com/d/msgid/jenkinsci-users/47b4e75b07734e298b5de5d91a07b124%40Diamond.ac.uk.
> For more options, visit https://groups.google.com/d/optout.
> 

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-users/56982394-0924-43CF-88E1-8B9ECAFD0A04%40beckweb.net.
For more options, visit https://groups.google.com/d/optout.

Users unable to build projects they're authorized for via role-strategy-plugin

[Benjamin Primrose]

I’m not sure if this is FYI or a plea for help☺  TL:DR, role-strategy-plugin 
evaluates user permissions by case-sensitively comparing the username as 
entered in Assign Roles with the way they typed their name when *logging in*.


Running:

   Jenkins 2.150.2 on windows server 2016
Active Directory plugin 2.10 (this may be incidental info)
Role-based Authorization Strategy 2.9.0


What’s happening:

I’m configuring a set of users with access.  Adding the users to project 
roles in “Manage Jenkins”->”Manage and Assign Roles”->”Assign Roles” works 
wonderfully.  More importantly, it is *case insensitive*.  User’s logons at 
this org have the initial letter of first and last name capitalized in active 
directory, but no matter what case they’re entered in here the lookup in AD 
succeeds.

The issue occurred when those users attempt to build the projects they’re 
authorized for—they can’t.  I have a secondary account of my own, which I added 
in the same way as the other users.  It could build projects, so I know my 
project role regex is OK.  The one other user who did work I’d lazily entered 
in all lower case instead of in the local “official” mixed-case format.  We 
went through the AD config for that user to figure out which field had their 
username in all lower case, but none did.  After some talking in circles, most 
users are entering their username in all lower case when logging in.  It 
appears the role-strategy-plugin compares the username logged in with *as 
typed* against the username entered in the Assign Roles config screen *as 
typed*.


I had expected either the Assign Roles screen and logging in to do a lookup 
against AD, and store the actual username.  The actual behavior is very 
finicky, and some users do enter their username in mixed case.  Does anyone 
have a fix or workaround for this?




Benjamin Primrose
Principal Developer
• Fitchburg, MA 01420

Ph:978-353-8054 • bprimr...@wcu.com



[https://www.wcu.com/wp-content/uploads/2018/10/WorkersLogo_4cp.png]



Confidentiality Notice:  The materials in this electronic mail transmission 
(including attachments) are private and confidential and are the property of 
the sender and Workers Credit Union.  Unless stated to the contrary, any 
opinions or comments are personal to the writer and do not represent the 
official view of Workers Credit Union.  If you are not the intended recipient, 
you are hereby notified that any use, dissemination, disclosure or copying of 
this communication is strictly prohibited.  If you have received this 
communication in error, please destroy all copies of this message and its 
attachments and notify us immediately.  Thank you.


-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-users/5c4200fc.1c69fb81.a63cb.3fdaSMTPIN_ADDED_MISSING%40gmr-mx.google.com.
For more options, visit https://groups.google.com/d/optout.

[no subject]

[David Karlsen]

I have a global workflow lib, and my scripts work just file, like the
"icpDeploy" one listed in [1] - but I cannot get the docs up in
https://myjenkins/pipeline-syntax/globals .
According to [2] the naming looks correct.
At some point in time this was working - but no longer - did something
change and the docs did not follow?

We're running Jenkins version "CloudBees Jenkins Enterprise
2.138.2.2-rolling"



[1]
Davids-Work-MacBook-Pro:vars et2448$ pwd
/Users/et2448/projects/workflowLibs/vars
Davids-Work-MacBook-Pro:vars et2448$ ls -l icp*
-rw-r--r--  1 et2448  staff  1548 Jan  9 11:39 icpDeploy.groovy
-rw-r--r--  1 et2448  staff  2286 Jan 18 13:45 icpDeploy.txt
Davids-Work-MacBook-Pro:vars et2448$

[2]
https://jenkins.io/doc/book/pipeline/shared-libraries/#defining-global-variables

-- 
--
David J. M. Karlsen - http://www.linkedin.com/in/davidkarlsen

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-users/CAGO7Ob1PCX%2Btbt3-VQ8GKxTNJkgtG8-%3Db5C_xf3PC4bGaNJTvg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: How can we achieve the same effect as Jenkins 1's "Deploy artifacts to Maven repository" with Jenkins 2's pipelines?

[Cyrille Le Clerc]

Hello Aaron, thanks David

As David said, the "Deploy artifacts to Maven repository" feature of the 
Maven Job type does not exist "as is" in the Pipeline Maven integration.

The recommended solution is to use the "-DdeployAtEnd=true" feature of 
Maven. See 
https://maven.apache.org/plugins/maven-deploy-plugin/deploy-mojo.html#deployAtEnd
 
.

Can you please describe more your need. Is it one of

   - Prevent partial upload of maven artifacts when a multi module project 
   fails
   - Introduce intermediate build steps between the completion of "mvn 
   verify" and the upload of the artifacts (the "deploy" part of the maven 
   build)
   - Have retires if the artifact repository is unvailable
   - Other

Cyrille




On Thursday, January 17, 2019 at 6:23:40 PM UTC+1, David Karlsen wrote:
>
> I use the option deployAtEnd in the maven plugin to achieve this 
>
> Den tor. 17. jan. 2019, 16:59 skrev Cyrille Le Clerc <
> clec...@cloudbees.com >:
>
>> Hello AAron,
>>
>> This capability is niot av
>>
>> On Wednesday, January 16, 2019 at 5:16:22 PM UTC+1, Aaron Digulla wrote:
>>>
>>> Hello,
>>>
>>> For releases, I'd like to build and test all Maven modules and after the 
>>> build, deploy everything at once (otherwise, someone has to waste time to 
>>> clean up the mess in Nexus).
>>>
>>> In Jenkins 1, this was simple: Build with "mvn clean install" and add a 
>>> post-build job "Deploy artifacts to Maven repository".
>>>
>>> Jenkins 2 still maintains a list of all artifacts which need to be 
>>> deployed but I couldn't find the out how to recreate the old post-build job.
>>>
>>> How do I do that?
>>>
>>> Regards,
>>>
>> -- 
>> You received this message because you are subscribed to the Google Groups 
>> "Jenkins Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to jenkinsci-use...@googlegroups.com .
>> To view this discussion on the web visit 
>> https://groups.google.com/d/msgid/jenkinsci-users/8813b207-d8f5-4718-9401-a130b475899b%40googlegroups.com
>>  
>> 
>> .
>> For more options, visit https://groups.google.com/d/optout.
>>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-users/8ae0e715-b510-4b20-b940-7d75a8f37c1d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: Kubernetes plugin - multi clusters

[Tristan FAURE]

Oops 🤐
Sorry I will test it. Thank you very much

Le ven. 18 janv. 2019 à 09:21, Carlos Sanchez  a écrit :

> In the pipeline you need the "cloud" parameter
>
>
> https://github.com/jenkinsci/kubernetes-plugin/blob/master/README.md#pod-and-container-template-configuration
>
> On Fri, Jan 18, 2019, 09:02 Tristan FAURE  wrote:
>
>> Thank you for your answer !
>>
>> So If i have a k8s cloud cloud1 and another one cloud2 I can use the
>> label to select one of them ?
>>
>> In this sample (see bellow) I don't see where I have to insert the label ?
>> pipeline {
>> agent {
>> kubernetes {
>> label "bd-${random}"
>> yaml """
>> spec:
>> containers:
>> - name: node
>> image: node:8
>> command:
>> - cat
>> tty: true
>> """
>> }
>> }
>>
>>
>> Le jeudi 17 janvier 2019 17:44:43 UTC+1, Carlos Sanchez a écrit :
>>>
>>> all cloud definitions are used by matching the labels of the pod
>>> templates and your job labels
>>>
>>>
>>> https://wiki.jenkins.io/display/JENKINS/Distributed+builds#Distributedbuilds-Nodelabelsforagents
>>>
>>>
>>> On Thu, Jan 17, 2019 at 5:29 PM Tristan FAURE 
>>> wrote:
>>>
 Hello
 The jenkins GUI allows the creation of several Kubernetes cloud, how
 does it work ?
 Are they all used or only one ? If many is OK Is there a way to select
 a specific cluster in my pipeline ?

 Thank you in advance

 Tristan FAURE

 --
 You received this message because you are subscribed to the Google
 Groups "Jenkins Users" group.
 To unsubscribe from this group and stop receiving emails from it, send
 an email to jenkinsci-use...@googlegroups.com.
 To view this discussion on the web visit
 https://groups.google.com/d/msgid/jenkinsci-users/CA%2BtQ8YPdE_ydXeZ6k1%2B4V07jQu8knFqby%2B4jsD0YpUpOjdCb8w%40mail.gmail.com
 
 .
 For more options, visit https://groups.google.com/d/optout.

>>> --
>> You received this message because you are subscribed to the Google Groups
>> "Jenkins Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to jenkinsci-users+unsubscr...@googlegroups.com.
>> To view this discussion on the web visit
>> https://groups.google.com/d/msgid/jenkinsci-users/4689b90c-7980-4ffc-8fab-9ee0799945f1%40googlegroups.com
>> 
>> .
>> For more options, visit https://groups.google.com/d/optout.
>>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "Jenkins Users" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/jenkinsci-users/eBHsxw01nmo/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> jenkinsci-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-users/CALHFn6PdB6a5S0qTogucnV2g7axfY%2Bi%2B-Y7Y_gpVz%2BCgh-cv7g%40mail.gmail.com
> 
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-users/CA%2BtQ8YPis%3D3KHjvauYVcbUoTEgVRD3KnR-WXAeMMNNGU5nEy3g%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: Kubernetes plugin - multi clusters

[Carlos Sanchez]

In the pipeline you need the "cloud" parameter

https://github.com/jenkinsci/kubernetes-plugin/blob/master/README.md#pod-and-container-template-configuration

On Fri, Jan 18, 2019, 09:02 Tristan FAURE  wrote:

> Thank you for your answer !
>
> So If i have a k8s cloud cloud1 and another one cloud2 I can use the label
> to select one of them ?
>
> In this sample (see bellow) I don't see where I have to insert the label ?
> pipeline {
> agent {
> kubernetes {
> label "bd-${random}"
> yaml """
> spec:
> containers:
> - name: node
> image: node:8
> command:
> - cat
> tty: true
> """
> }
> }
>
>
> Le jeudi 17 janvier 2019 17:44:43 UTC+1, Carlos Sanchez a écrit :
>>
>> all cloud definitions are used by matching the labels of the pod
>> templates and your job labels
>>
>>
>> https://wiki.jenkins.io/display/JENKINS/Distributed+builds#Distributedbuilds-Nodelabelsforagents
>>
>>
>> On Thu, Jan 17, 2019 at 5:29 PM Tristan FAURE 
>> wrote:
>>
>>> Hello
>>> The jenkins GUI allows the creation of several Kubernetes cloud, how
>>> does it work ?
>>> Are they all used or only one ? If many is OK Is there a way to select a
>>> specific cluster in my pipeline ?
>>>
>>> Thank you in advance
>>>
>>> Tristan FAURE
>>>
>>> --
>>> You received this message because you are subscribed to the Google
>>> Groups "Jenkins Users" group.
>>> To unsubscribe from this group and stop receiving emails from it, send
>>> an email to jenkinsci-use...@googlegroups.com.
>>> To view this discussion on the web visit
>>> https://groups.google.com/d/msgid/jenkinsci-users/CA%2BtQ8YPdE_ydXeZ6k1%2B4V07jQu8knFqby%2B4jsD0YpUpOjdCb8w%40mail.gmail.com
>>> 
>>> .
>>> For more options, visit https://groups.google.com/d/optout.
>>>
>> --
> You received this message because you are subscribed to the Google Groups
> "Jenkins Users" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to jenkinsci-users+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/jenkinsci-users/4689b90c-7980-4ffc-8fab-9ee0799945f1%40googlegroups.com
> 
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-users/CALHFn6PdB6a5S0qTogucnV2g7axfY%2Bi%2B-Y7Y_gpVz%2BCgh-cv7g%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

Re: Kubernetes plugin - multi clusters

[Tristan FAURE]

Thank you for your answer !

So If i have a k8s cloud cloud1 and another one cloud2 I can use the label 
to select one of them ?

In this sample (see bellow) I don't see where I have to insert the label ?
pipeline {
agent {
kubernetes {
label "bd-${random}"
yaml """
spec:
containers:
- name: node
image: node:8
command:
- cat
tty: true
"""
}
}


Le jeudi 17 janvier 2019 17:44:43 UTC+1, Carlos Sanchez a écrit :
>
> all cloud definitions are used by matching the labels of the pod templates 
> and your job labels
>
>
> https://wiki.jenkins.io/display/JENKINS/Distributed+builds#Distributedbuilds-Nodelabelsforagents
>
>
> On Thu, Jan 17, 2019 at 5:29 PM Tristan FAURE  > wrote:
>
>> Hello
>> The jenkins GUI allows the creation of several Kubernetes cloud, how does 
>> it work ? 
>> Are they all used or only one ? If many is OK Is there a way to select a 
>> specific cluster in my pipeline ?
>>
>> Thank you in advance
>>
>> Tristan FAURE
>>
>> -- 
>> You received this message because you are subscribed to the Google Groups 
>> "Jenkins Users" group.
>> To unsubscribe from this group and stop receiving emails from it, send an 
>> email to jenkinsci-use...@googlegroups.com .
>> To view this discussion on the web visit 
>> https://groups.google.com/d/msgid/jenkinsci-users/CA%2BtQ8YPdE_ydXeZ6k1%2B4V07jQu8knFqby%2B4jsD0YpUpOjdCb8w%40mail.gmail.com
>>  
>> 
>> .
>> For more options, visit https://groups.google.com/d/optout.
>>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to jenkinsci-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/jenkinsci-users/4689b90c-7980-4ffc-8fab-9ee0799945f1%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.