Jenkins Overall/Read permission

Question

When opening my Jenkins in the URL I cant seem to log in it throws out the message "User is missing the Overall/Read permission". I have tried the answer from a similar question but disabling the security does not work. Jenkins continue's to throw out the error. Somebody recommended that I remove the file all together but also failed. Any other solution anybody could supply me with?

Posts I have visited already include: Jenkins Wiki

Did you try to set a JENKINS_HOME environment variable to force Jenkins using the relevant Jenkins home folder? — Bruno Lavit, Apr 25 '16 at 14:02
No that doesn't work, but I must add you just showed me where to fix another problem I had with Jenkins and that one was more important thank you! — Ruben Redman, Apr 26 '16 at 06:22

score 27 · Answer 1 · edited Sep 04 '17 at 07:54

27

Edit the /var/lib/jenkins/config.xml file and add you as an Admin as follows:

<authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy">
.
.
<permission>hudson.model.Hudson.Administer:***Here is your username***</permission>
.
.
</authorizationStrategy>

Don't forget to go to restart the Server. Hope this helps!

edited Sep 04 '17 at 07:54

Raktim Biswas

4,011
5
27
32

answered Apr 26 '16 at 10:43

gXg

508
4
6

1

I like your enthusiasm but unfortunately didn't work. Even tried creating a new account and changing config settings to new account details still the same error. – Ruben Redman Apr 26 '16 at 11:56
1

This worked well for me on Jenkins 2.32.2. Seems much easier than completely reinstalling Jenkins. – steve Feb 10 '17 at 21:00

score 12 · Answer 2 · answered Aug 10 '18 at 16:10

12

I discovered one additional scenario where this might occur:

I had a user that was defined with an all lowercase username (e.g. "john.doe"), but when this user was assigned a role their username was entered with different casing (e.g. "John.Doe"). In this case, the user was able to login, but the role was not associated correctly and therefore the overall/read permission was not granted.

To fix this, I simply deleted the bad record for the role assignment and recreated it with proper casing.

answered Aug 10 '18 at 16:10

BrianV

961
8
9

Case sensitivity for the user and the role assignment is important – Scott Robert Schreckengaust May 10 '19 at 17:28
2

Thanks Brian! Exactly the same happened to us right now. The mistake is coming from the fact that Jenkins converts to lower case user details when you save it. – Gregory Danenberg Feb 12 '21 at 07:07
This was my case, It still shows the name of the user as if it was correctly assigned, but the role is not applied. Thanks for the help. – AxelWass Oct 26 '22 at 09:10

score 9 · Answer 3 · answered Oct 19 '17 at 08:36

Disabling Security
One may accidentally set up security realm / authorization in such a way that you may no longer able to reconfigure Jenkins.

When this happens, you can fix this by the following steps:

Stop Jenkins (the easiest way to do this is to stopthe servlet container.)
Go to $JENKINS_HOME in the file system and find config.xml file.
Open this file in the editor.
Look for the <useSecurity>true</useSecurity> element in this file.
Replace true with false
Remove the elements authorizationStrategy and securityRealm
Start Jenkins
When Jenkins comes back, it will be in an unsecured mode where everyone gets full access to the system.
If this is still not working, trying renaming or deleting config.xml.

above was quoted from https://jenkins.io/doc/book/system-administration/security/

So Once we come back to jenkins in unsecured mode we need to delete the users and add a new user .

Is this a recommended way to disable security. Also is not there a risk of losing data of deleted users? — Valentine Sean, Oct 09 '22 at 15:00

score 3 · Answer 4 · answered Nov 28 '17 at 14:42

3

[Project-based Matrix Authorization Strategy related]

Hello there, the same error happened to me when I unchecked the global/read permission for anonymous.

If you are using the project based matrix ahtorization plugin, for an unclear reason, this read permission seems to be required by the plugin.

answered Nov 28 '17 at 14:42

slonepi

164
2
6

1

in that case, do we have to assign global permissions for the user ? – vigamage Nov 09 '18 at 11:31

score 2 · Answer 5 · answered Apr 27 '17 at 12:04

In Windows: When I've enabled the LDAP under Global security, I lost my admin right too. with error as "Access Denied is missing the Overall/Read permission jenkins windows".

In such case, Please retain the existing instance, have a new jenkins install on someother machine or VM. Copy the config.xml from Jenkins_Home and replace it with config.xml from your Jenkin_Home directory. While performing this, ensure Jenkins service is stopped. once replaced, Start the instance and VOILA.

score 2 · Answer 6 · answered Jul 21 '17 at 12:44

2

Restart your jenkins server using below command,

service jenkins restart

It works for me.

answered Jul 21 '17 at 12:44

kalaivani

484
1
5
8

score 1 · Answer 7 · answered Dec 22 '20 at 02:53

1

I was also having the same issue. Adding fresh roles from Manage and assign Roles section and assigning them to the users worked for me.

answered Dec 22 '20 at 02:53

Abhishek Mishra

111
1
10

score 0 · Answer 8 · answered Nov 21 '19 at 08:40

In my case (Jenkins v 2.205) I edited JENKINS_HOME in jenkins.xml in windows, to move the workspace due to a bug from angular / webpack in a project. What I didn't realize is that you must move a whole host of files and folders, not just workspace and jobs subfolders. Here's a list of what I ended up moving to the new location (with Jenkins stopped, of course):

[folder] fingerprints
[folder] jobs
[folder] logs
[folder] nodes
[folder] plugins
[folder] secrets
[folder] tools
[folder] updates
[folder] userContent
[folder] users
[folder] workflow-libs
[folder] workspace
[file] .lastStarted
[file] config.xml
[file] credentials.xml
[file] **plugin-configuration.xml (any file that is configuring one of your plugins)
[file] hudson.*.xml (all hudson files)
[file] identity.key.enc
[file] jenkins.* (all Jenkins files)
[file] locale.xml
[file] nodeMonitors.xml
[file] org.*.xml (all org config files)
[file] queue.xml
[file] scriptApproval.xml
[file] secret.key
[file] secret.key.not-so-secret

I'm not entirely sure if ALL of them were required, but I'm pretty sure all the hudson, jenkins and users/secrets/credentials are needed

Are you sure that you replied on the correct question? I can't see why moving these files and directories would resolve a permissions issue. — Cameron Hudson, Jan 15 '20 at 22:52
As I say in my answer, my error was related to me: - changing the configuration in the xml file - not moving the entire thing, not just the __workspace__ folder, which I had. I believe it is rellevant then because: .- I had the error - I solved the error. Also I explain how exactly. — tfrascaroli, Jan 16 '20 at 11:21

score 0 · Answer 9 · answered Mar 08 '21 at 08:58

User is missing the Overall/Read permission sometime we forget to update the security configuration after adding the user in jobs,

https://<jenkins-url>/configureSecurity/ under Authorization Strategy, Provide Overall permission to list and access the jobs that has permission to access

Jenkins Overall/Read permission

9 Answers9

Linked