'User is missing the Overall/Read permission' error with Jenkins GitHub OAuth Plugin

Question

I'm using the github oauth plugin for our logins but for all of our users in the Organisation I get an error:

Access Denied

<user> is missing the Overall/Read permission

I have tried everything I can possibly think of to try to make this work and I'm probably going to fallback to making everyone an admin user, which i would prefer not to do.

Any advise would be appreciated.

score 72 · Answer 1 · edited Jul 07 '16 at 18:59

72

This is how I resolved the authentication problem:

Edit config.xml file, e.g.
```
sudo vi /var/lib/jenkins/config.xml
```
1. Change useSecurity element's value to false, e.g.
```
<useSecurity>false</useSecurity>
```
2. Remove authorizationStrategy block
Restart Jenkins: /etc/init.d/jenkins restart.
Access Jenkins through URL as usual and reconfigure security again.

edited Jul 07 '16 at 18:59

kenorb

155,785
88
678
743

answered Feb 03 '15 at 16:08

Tom Johns

965
1
7
9

15

Just like on the dancefloor, back that thang up: cp -R /var/lib/jenkins /var/lib/BACKUP-jenkins – Jacob McKay Feb 05 '15 at 23:16
35

Note that the question is about how to make security work, not how to restart Jenkins without security to be able to access it. – giorgiosironi Jul 27 '16 at 08:58
True but, thanks so much I thought I had lost my jenkins installation after locking the administrator out by accident – derHugo Jan 11 '18 at 16:00
If we do this all current users will lose their user name and password right and have to create a new password all user? what if I just have reset permission of one user only? – Ashish Karpe Dec 19 '19 at 10:34
We just experienced similar issue. It happened after adding a new user to role. To resolve it I changed useSecurity to false, restarted the Jenkins, then stopped Jenkins again and reverted the parameter to be true... somehow it solved the issue. Would happy to know if someone knows RC for this problem and how to prevent in the future. – Gregory Danenberg Feb 12 '21 at 06:51
I googled a bit more and found why is happened on our machine. Similar case as here https://stackoverflow.com/a/51790352/1085076 – Gregory Danenberg Feb 12 '21 at 07:08

score 25 · Answer 2 · answered Dec 06 '16 at 13:57

25

I had the same problem with "... is missing the Overall/Read permission" on Jenkins (1.651.2) with activated Credentials Plugin.

But it was my own failure: I only configured the user on project side (by credential plugin) but missed to configure the global security.

So I fixed it by selecting:

Jenkins -> Manage Jenkins -> Configure Global Security

And did setup missing global settings (or project matrix based one)

answered Dec 06 '16 at 13:57

de-jcup

1,402
12
27

1

Thank you. Your solution was awesome when i added new user. I faced the same error and resolved. – gubs Feb 25 '19 at 20:45
Yes, this is the right answer without compromising the Security. Thanks – Krishna Apr 30 '21 at 16:52

Slav · Answer 3 · 2014-03-28T16:33:46.347

17

Have you followed this step, from the plugin page?

Control user authorization (i.e. who is allowed to see the jobs and build them) using the Github Commiter Authorization Strategy

Also, make sure you actually allow authenticated users to access Jenkins

Under Jenkins global configuration, under Authorization, add user/group called authenticated
Give that group Overall Read permission
The group should show up with a "group" icon (two users), as opposed to single user icon.

edited Mar 28 '14 at 16:33

answered Mar 28 '14 at 16:20

Slav

27,057
11
80
104

Yes i added our organisation, Blooie, to the list but the members of the organisation can't login. They all get the above error – real_ate Mar 28 '14 at 16:23
1

Did you setup `authenticated` group to have permissions at all? I've updated the answer – Slav Mar 28 '14 at 16:34
2

Ok so now i'm really really confused... you ask if i followed the step from the plugin page and this is all that step says: https://cloudup.com/cfbsnzHGBxA . I'm using the github authorization strategy and my users are public members of our organisation. Now you're talking about "Global Configuration", I assume that you mean "Global Security Configuration" https://cloudup.com/cfFzfQ8bYol I've gone to the Authorization section in the Global Security Configuration and i don't see anything related to groups: https://cloudup.com/cdPRoZ0xqxT Am i missing something? – real_ate Mar 29 '14 at 21:13
I assume that the comments about 'authenticated' group are assuming that you are using "Project-based Matrix Authorization Strategy" -- which it sounds like you are not: https://i.imgsafe.org/218e656913.png – Alexander Bird Aug 03 '16 at 16:17

score 6 · Answer 4 · answered Jul 10 '14 at 12:02

6

reset from <useSecurity>true</useSecurity> to <useSecurity>false</useSecurity> in config.xml and set the permission again.

answered Jul 10 '14 at 12:02

BMW

42,880
12
99
116

I think this is simpler than removing entire blocks of XML – Jonathan Jun 24 '16 at 18:30

score 5 · Answer 5 · edited Sep 01 '17 at 14:05

5

Edit file /var/lib/jenkins/config.xml and add the following lines :

  <authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy">
    <permission>hudson.model.Hudson.Read:john.smith</permission>
  </authorizationStrategy>

Restart Jenkins

edited Sep 01 '17 at 14:05

Shivam Jha

182
3
17

answered Apr 22 '16 at 12:24

metatechbe

657
9
9

Nice and succinct. Saves faffing about with turning security off and on again, etc. – Dezzamondo Aug 24 '17 at 20:31

score 4 · Answer 6 · answered Mar 17 '16 at 13:35

4

What I did when I got this error is to edit config.xml as mentionned by other users and correctly re-add my username in LOWERCASE in "configureSecurity" Jenkins' page. I was using "KrustyHack" when adding permissions but it didn't work. I had to add "krustyhack" instead, and it worked.

I hope it helps.

answered Mar 17 '16 at 13:35

KrustyHack

410
3
7

2

I had the problem in the question and fixed it in the similar way as this answer mentions. However, I did that editing the config directly: `sed -i '' -e 's/:Admin/:admin/g' Home/config.xml`. a little bit more information is here: http://www.egeek.me/2015/03/07/jenkins-admin-is-missing-the-overall-read-permission/ – eugene Aug 08 '16 at 03:13

score 3 · Answer 7 · answered Jul 02 '15 at 14:50

I had the same problem here, but it affected only some users, not all of them. Anyway, you should check public organization membership : documentation of the plugin states that "You have to be a public member of the organization for the authorization to work correctly." (https://wiki.jenkins-ci.org/display/JENKINS/Github+OAuth+Plugin).

Follow instructions from GitHub (https://help.github.com/articles/publicizing-or-hiding-organization-membership/) in order to make organization membership public, and this might fix your issue.

score 3 · Answer 8 · edited Dec 07 '15 at 16:38

3

Also check the case user names in the authorizationStrategy element. I made my new user's name lower case and restarted the service and it the error went away.

edited Dec 07 '15 at 16:38

Bartłomiej Semańczyk

59,234
49
233
358

answered Dec 07 '15 at 16:17

Terry Mandin

140
1
3
11

My user was getting an error of FRED@mycompany.com is missing the Overall/Read permission. I had that user in my jenkins matrix as fred@mycompany.com. As soon as I added FRED@mycompany.com to the Jenkins matrix, that user could login ok. – Will Oct 19 '16 at 12:45

kenorb · Answer 9 · 2016-09-23T15:34:39.157

3

Fix it by these 2 shell commands on the server (sudo permission is required):

sudo ex +g/useSecurity/d +g/authorizationStrategy/d -scwq /var/lib/jenkins/config.xml
sudo /etc/init.d/jenkins restart

This will remove useSecurity and authorizationStrategy lines from your config file.

See also: Disable security at Jenkins website

edited Sep 23 '16 at 15:34

answered Jul 07 '16 at 19:07

kenorb

155,785
88
678
743

score 2 · Answer 10 · answered Jan 29 '18 at 11:35

We hit this same error when a github organization administrator changed the organization's settings for "Third-party access" to "restrict third-party application access". Reverting to the previous settings within the github organization resolved the problem.

See github oauth-app-access-restrictions for details on how to configure that properly.

score 2 · Answer 11 · answered Apr 10 '18 at 20:26

The assignment of roles to users is stored in config.xml file. Add the ID of the user directly to the role and then restart Jenkins.

In my case, I have a role named editor and a bunch of users assigned to the role.

 <role name="editor" pattern=".*">
     <permissions>
         <...>
         <permission>hudson.model.Item.Create</permission>
         <permission>hudson.model.Item.Workspace</permission>
         <permission>...</permission>
     </permissions>
     <assignedSIDs>
         <sid>bob</sid>
         <sid>alice</sid>
         <sid>**newuser**</sid>   
     </assignedSIDs>
  </role>

score 1 · Answer 12 · answered Jun 04 '14 at 00:22

The matrix security is not terribly clear. I am a member of a specific group in our org that has admin privileges however I am also an authenticated user. I would think that the one group super-cedes the other however I have to have both in order to actually log into the system and be admin. It's screwed up IMO.

score 1 · Answer 13 · answered Mar 15 '22 at 17:52

1

go to your-jenkins-host:port/role-strategy/assign-roles and configure roles for the user

answered Mar 15 '22 at 17:52

naXa stands with Ukraine

35,493
19
190
259

score 0 · Answer 14 · edited Nov 14 '17 at 15:00

0

Go to $JENKINS_HOME (linux, jenkins in windows), and find config.xml file.
Open this file in the editor. (take backup of .jenkins home)
Look for the <useSecurity>true</useSecurity> element in this file.
Replace "true" with "false"
Remove the elements authorizationStrategy and securityRealm
Start Jenkins

edited Nov 14 '17 at 15:00

fedorqui

275,237
103
548
598

answered Jan 09 '15 at 05:15

Panchakarla Srinivas

33
1

1

Nice try, Nigerian Prince. – Cameron Hudson Jan 15 '20 at 22:18

score 0 · Answer 15 · answered Nov 20 '15 at 02:21

0

I had the same problem before, your OAuth application need your organization owner's approve, then the OAuth Plugin can access the private data in it

answered Nov 20 '15 at 02:21

Ethan Wu

87
6

score 0 · Answer 16 · answered Feb 18 '16 at 11:07

I am using Crowd 2 plugin and I have the same problem. I fixed it by downgrading OWASP Markup Formatter Plugin from varsion 1.2 to version 1.1 and then changing Markup Formatter in Configure Global Security value to Raw HTML, before it was Plain text.

score 0 · Answer 17 · answered Jun 01 '16 at 11:54

I had exactly the same problem and adding the plugin Role Strategy Plugin fixed the problem.

All I had to do was install the plugin, create two groups - admin / developer and then add users to the groups.

A much much better solution than recreating the whole permissions matrix :)

score 0 · Answer 18 · answered Sep 13 '17 at 14:53

I had a similar problem I was not able access Jenkin account and the system was locked. I had only an error message. "Access Denied "

When I tried to reinstall Jenkins then it prompted to Repair option. By clicking Repair option it fixed the problem.

score 0 · Answer 19 · answered Jan 30 '22 at 18:08

0

I found it in C:\ProgramData\Jenkins\.jenkins

Jenkins Version: 2.319.2

answered Jan 30 '22 at 18:08

Harsha W

3,162
5
43
77

score 0 · Answer 20 · answered Nov 21 '22 at 18:02

Instead of removing all security (the top answer), Add admin access as root, to the user you want to give admin to. We had the same issue where all admins were no longer with the company. This is how I resolved the authentication problem: I logged into:

 jenkins@<jenkins server>:/var/lib/jenkins/

Edit config.xml file, and add a config for

<permission>hudson.model.Hudson.Administer:<username></permission>

Then restart Jenkins:

root@<jenkins server>:/$ /etc/init.d/jenkins restart

score -1 · Answer 21 · answered Feb 08 '17 at 12:17

-1

Just use Jenkins > Configure Global Security bottom page matrix to provide permissions to the user (start w/ read)

answered Feb 08 '17 at 12:17

Moshe Kaplan

36
6

1

I can't access that, the system is locked and all I can see is this error message. – Yaron Aug 24 '17 at 07:42

score -1 · Answer 22 · answered Apr 18 '17 at 00:13

I edited the /var/lib/jenkins/config.xml file and replaced the

<authorizationStrategy>...</authorizationStrategy>

with

<authorizationStrategy class="hudson.security.FullControlOnceLoggedInAuthorizationStrategy">
    <denyAnonymousReadAccess>true</denyAnonymousReadAccess>
</authorizationStrategy>

It is the default settings after installation. Then restart the jenkins service.

'User is missing the Overall/Read permission' error with Jenkins GitHub OAuth Plugin

22 Answers22

Linked