Jenkins python api authentication "403 forbidden"

Question

I'm trying to use jenkinsapi python library to work with Jenkins. My Jenkins is setup to authenticate with LDAP (with Active Directory Plugin). However, when I run my script to authenticate I fails (actually it ran once, but since then I get 403 Forbidden error every time)

it fails from the start:

from jenkinsapi.jenkins import Jenkins
j = Jenkins("https://qaa.server.com/jenkins", "username", "password")

Traceback (most recent call last):
  File "C:\eclipse-SDK-4.2-win32-x86_64\eclipse\plugins\org.python.pydev_2.6.0.2012062818\pysrc\pydevd.py", line 1392, in <module>
    debugger.run(setup['file'], None, None)
  File "C:\eclipse-SDK-4.2-win32-x86_64\eclipse\plugins\org.python.pydev_2.6.0.2012062818\pysrc\pydevd.py", line 1085, in run
    pydev_imports.execfile(file, globals, locals) #execute the script
  File "C:\work\selenium-project\ses-web\utils\mark_slave_offline.py", line 10, in <module>
    j = Jenkins("https://qaa.server.com/jenkins", "username", "password")
  File "C:\Python27\lib\site-packages\jenkinsapi-0.1.11-py2.7.egg\jenkinsapi\jenkins.py", line 43, in __init__
    JenkinsBase.__init__(self, baseurl, formauth=formauth)
  File "C:\Python27\lib\site-packages\jenkinsapi-0.1.11-py2.7.egg\jenkinsapi\jenkinsbase.py", line 34, in __init__
    self.poll()
  File "C:\Python27\lib\site-packages\jenkinsapi-0.1.11-py2.7.egg\jenkinsapi\jenkinsbase.py", line 41, in poll
    self._data = self._poll()
  File "C:\Python27\lib\site-packages\jenkinsapi-0.1.11-py2.7.egg\jenkinsapi\jenkinsbase.py", line 45, in _poll
    return retry_function(self.RETRY_ATTEMPTS , self.get_data, url)
  File "C:\Python27\lib\site-packages\jenkinsapi-0.1.11-py2.7.egg\jenkinsapi\utils\retry.py", line 39, in retry_function
    raise e
urllib2.HTTPError: HTTP Error 403: Forbidden

what's interesting is that the following code works just fine every time:

def urlopen(url,username=None, password=None, data=None):
    '''Open a URL using the urllib2 opener.'''
    request = urllib2.Request(url, data)
    base64string = base64.encodestring('%s:%s' % (username, password)).replace('\n', '')
    request.add_header("Authorization", "Basic %s" % base64string)
    response = urllib2.urlopen(request)
    return response

result = urlopen('https://qaa.server.com/jenkins', "username", "password")

QUESTION: Why is the Jenkins code failing? Could it be the apache server misconfigured?

thanks!

UPDATE: This is what I'm getting as a responce

<html>
    <head>
        <meta http-equiv='refresh' content='1;url=/jenkins/loginfrom=%2Fjenkins%2Fapi%2Fpython%2F'/>
        <script>window.location.replace('/jenkins/login?from=%2Fjenkins%2Fapi%2Fpython%2F');
        </script>
    </head>
<body style='background-color:white; color:white;'>Authentication required</body>
</html>

Apache access.log: - [07/Sep/2012:15:24:21 -0400] "GET /jenkins/api/python/ HTTP/1.1" 403 593

UPDATE: error.log at debug mode:

.....
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1897): OpenSSL: read 160/160 bytes from BIO#e08150 [mem: e96ea5] (BIO dump follows)
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1830): +-------------------------------------------------------------------------+
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0000: 64 c2 ac 70 d0 d6 22 02-ef 56 98 32 6e 16 20 53  d..p.."..V.2n. S |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0010: 84 fb 94 c7 51 a4 a8 9c-b3 8f 48 c8 84 1e 46 6b  ....Q.....H...Fk |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0020: 15 c9 f4 cb ef cf 38 ed-a1 8b 41 08 a6 3b 95 f0  ......8...A..;.. |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0030: bd b3 05 ef 68 68 e0 fb-52 92 ad fc 7f aa 72 50  ....hh..R.....rP |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0040: 9e d9 7d 98 18 82 eb 07-bb 45 e3 e5 b2 93 6d 34  ..}......E....m4 |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0050: fe 18 b5 d4 5c c9 78 c9-78 0c 6b cb 50 80 96 6d  ....\\.x.x.k.P..m |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0060: 49 8a 39 b2 73 b2 ae 76-a4 d3 50 7a 38 a7 54 72  I.9.s..v..Pz8.Tr |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0070: 41 e5 13 b2 1f 71 a1 b0-db 89 81 4f 14 3a 93 18  A....q.....O.:.. |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0080: 5a e0 0e 9e c9 d9 1e f3-01 53 eb 08 dc 23 89 fd  Z........S...#.. |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1869): | 0090: a0 13 81 ac 26 55 54 fd-22 64 7e 37 f3 cd 2d af  ....&UT."d~7..-. |
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_io.c(1875): +-------------------------------------------------------------------------+
[Fri Sep 07 16:52:09 2012] [info] Initial (No.1) HTTPS request received for child 63 (server qaa.server.com:443)
[Fri Sep 07 16:52:09 2012] [debug] mod_proxy_http.c(56): proxy: HTTP: canonicalising URL //localhost:8180/jenkins/api/python/
[Fri Sep 07 16:52:09 2012] [debug] proxy_util.c(1506): [client 207.***.***.1*2] proxy: http: found worker http://localhost:8180/jenkins for http://localhost:8180/jenkins/api/python/
[Fri Sep 07 16:52:09 2012] [debug] mod_proxy.c(1015): Running scheme http handler (attempt 0)
[Fri Sep 07 16:52:09 2012] [debug] mod_proxy_http.c(1973): proxy: HTTP: serving URL http://localhost:8180/jenkins/api/python/
[Fri Sep 07 16:52:09 2012] [debug] proxy_util.c(2011): proxy: HTTP: has acquired connection for (localhost)
[Fri Sep 07 16:52:09 2012] [debug] proxy_util.c(2067): proxy: connecting http://localhost:8180/jenkins/api/python/ to localhost:8180
[Fri Sep 07 16:52:09 2012] [debug] proxy_util.c(2193): proxy: connected /jenkins/api/python/ to localhost:8180
[Fri Sep 07 16:52:09 2012] [debug] proxy_util.c(2444): proxy: HTTP: fam 2 socket created to connect to localhost
[Fri Sep 07 16:52:09 2012] [debug] proxy_util.c(2576): proxy: HTTP: connection complete to 127.0.0.1:8180 (localhost)
[Fri Sep 07 16:52:09 2012] [debug] mod_proxy_http.c(1743): proxy: start body send
[Fri Sep 07 16:52:09 2012] [debug] mod_proxy_http.c(1847): proxy: end body send
[Fri Sep 07 16:52:09 2012] [debug] proxy_util.c(2029): proxy: HTTP: has released connection for (localhost)
[Fri Sep 07 16:52:09 2012] [debug] ssl_engine_kernel.c(1884): OpenSSL: Write: SSL negotiation finished successfully
[Fri Sep 07 16:52:09 2012] [info] [client 207.***.***.1*2] Connection closed to child 63 with standard shutdown (server qaa.server.com:443)

What is the source of the error: Apache, LDAP or Jenkins? Have you checked the logs? — stark, Sep 07 '12 at 17:38
@stark I've updated what I get as a response. So it looks like authentication is not even tried? — Alex Okrushko, Sep 07 '12 at 19:29
@stark `ipaddress [07/Sep/2012:15:24:21 -0400] "GET /jenkins/api/python/ HTTP/1.1" 403 593` — Alex Okrushko, Sep 07 '12 at 20:26
Ok. Then your problem is that your error log looks just like your access log. — stark, Sep 07 '12 at 20:38
@stark Sorry, that was my access.log. Error.log has nothings. it is set at LogLevel warn. — Alex Okrushko, Sep 07 '12 at 20:51
@Alex did you ever solve this? I'm suffering the same problem. — KomodoDave, Jan 11 '13 at 10:39
@KomodoDave, the solution is to use different module. I've posted the answer below. — Alex Okrushko, Jan 11 '13 at 13:04
possible duplicate of [Jenkins: HTTP error 403 when getting config](http://stackoverflow.com/questions/12462620/jenkins-http-error-403-when-getting-config) — dnozay, Jun 04 '14 at 22:54

score 9 · Accepted Answer · answered Jan 11 '13 at 13:03

9

Solution for this problem is to use different python-jenkins module

With this module everything works fine:

import jenkins
j = jenkins.Jenkins(base_url, username, password)

answered Jan 11 '13 at 13:03

Alex Okrushko

7,212
6
44
63

@KomodoDave, no problem. The deeper problem with `jenkinsapi` module and their authentication seems to be in how they created the request with auth header. But that's deeper that I was willing to research. – Alex Okrushko Jan 11 '13 at 13:11
Completely understandable. Since it's so trivial to simply decode the json from `http://yourjenkins/api/json` I decided to go that way. This makes for a script with no dependencies either, which is a good thing. But I wanted to understand whether I was doing something silly wrong, hence asking you for how you solved the problem. Thanks again. – KomodoDave Jan 11 '13 at 13:14
one more hint, the password could be a token instead of real password, token can be got from user's profile – Larry Cai Aug 12 '13 at 03:03

score 0 · Answer 2 · edited May 23 '17 at 12:07

0

Since jenkinsapi leverages urllib2 you can use an opener to handle the authentication.

See this answer: https://stackoverflow.com/a/24048578/1733117

edited May 23 '17 at 12:07

Community

1
1

answered Jun 04 '14 at 22:54

dnozay

23,846
6
82
104

Jenkins python api authentication "403 forbidden"

2 Answers2