Restricting visibility of Jenkins jobs to specific users

Question

In Jenkins, is there a way to restrict certain jobs so that only specific users can view them?

Jenkins allows the restriction of user-abilities-per-project via the "Project-based Matrix Authorization Strategy". The problem is that a user can not access anything without the 'Overall' 'Read' setting. This seems to allow them to view all jobs.

Is there another plugin that would allow job visibility restrictions?

score 67 · Accepted Answer · edited Jan 22 '18 at 19:17

67

Think this is, what you are searching for: Allow access to specific projects for Users

Short description without screenshots:
Use Jenkins "Project-based Matrix Authorization Strategy" under "Manage Jenkins" => "Configure System". On the configuration page of each project, you now have "Enable project-based security". Now add each user you want to authorize.

edited Jan 22 '18 at 19:17

Michael Mrozek

169,610
28
168
175

answered Mar 29 '12 at 12:29

Christian

1,487
1
14
11

1

Looks like you still need to open up the Overall read setting as OP suggests. I've tried everything and can't get the project-based security settings to do anything without checking that Overall read. Could be that I'm using LDAP, but it works fine at the global level. – quickshiftin Aug 06 '12 at 06:18
4

You do have to check the Overall Read, but then on the project you are securing, just make sure to check "Do not inherit global permissions". That way, the user you don't want to see the project will not see it. – metaforge Feb 09 '15 at 19:47
5

"Project-based Matrix Authorization Strategy" is not under "Manage Jenkins" => "Configure System" , it is under "Manage Jenkins" => "Configure Global Security" – cowlinator Jan 15 '20 at 02:47

score 16 · Answer 2 · edited Feb 17 '20 at 04:54

16

Only one plugin help me: Role-Based Strategy :

wiki.jenkins-ci.org/display/JENKINS/Role+Strategy+Plugin

But official documentation (wiki.jenkins-ci.org/display/JENKINS/Role+Strategy+Plugin) is deficient.

The following configurations worked for me:

configure-role-strategy-plugin-in-jenkins

Basically you just need to create roles and match them with job names using regex.

edited Feb 17 '20 at 04:54

Manohar Reddy Poreddy

25,399
9
157
140

answered Jul 21 '16 at 23:58

JRichardsz

14,356
6
59
94

This is the key in the documentation - `Step 9. Add Project Roles based on each project.` – Vishnu Haridas Feb 10 '17 at 07:39
Learning Academy links are broken. – Kyle Martin Apr 25 '18 at 19:14
1

I converted to pdf just in case : https://github.com/jrichardsz/jenkins-tips-snippets-templates/blob/master/kblearningacademy_com_jenkins_Role%2BStrategy%2BPlugin.pdf – JRichardsz Apr 25 '18 at 20:25
Please remove the URL to kblearningacademy, as it doesn't work and redirects to a malicious site. My corporate firewall blocked it. – Dominik Jul 12 '19 at 13:31

score 8 · Answer 3 · answered Nov 21 '12 at 11:39

You could use Project-based Matrix Auth Strategy and enable Read Overall permission, but disable Read Job on the system level. After that you should enable Read Job for each specific project you've wanted to make visible for the current user. Please refer to this resolved issue for more info. Some info from there:

I am implementing READ permission at the job level. When this is done, a user that lacks the READ permission for a particular job will not: see that job in any view, be able to access the job page directly, see any reference to the job (for instance in upstream or downstream dependencies)

Also, I recommend you to go further and check out Role Strategy Plugin. It can simplify user/role management, you can use the described above to give access to the certain jobs.

Rostislav Matl · Answer 4 · 2015-09-24T13:12:20.243

I use combination of several plugins - for the basic assignment of roles and permission I use Role Strategy Plugin.

When I need to split some role depending on parameters (e.g. everybody with job-runner is able to run jobs, but user only user UUU is allowed to run the deployment job to deploy on machine MMM), I use Python Plugin and define a python script as first build step and end with sys.exit(-1) when the job is forbidden to be run with the given combination of parameters.

Build User Vars Plugin provides me the information about the user executing the job as environment variables.

E.g:

import os
import sys

print os.environ["BUILD_USER"], "deploying to", os.environ["target_host"]

# only some users are allowed to deploy to servers "MMM"
mmm_users = ["UUU"]

if os.environ["target_host"] != "MMM" or os.environ["BUILD_USER"] in mmm_users:
    print "access granted"
else:
    print "access denied"
    sys.exit(-1)

score 2 · Answer 5 · answered Jan 16 '18 at 09:14

As mentioned above by Vadim Use Jenkins "Project-based Matrix Authorization Strategy" under "Manage Jenkins" => "Configure System". Don't forget to add your admin user there and give all permissions. Now add the restricted user there and give overall read access. Then go to the configuration page of each project, you now have "Enable project-based security" option. Now add each user you want to authorize.

score 0 · Answer 6 · answered Aug 28 '14 at 12:01

0

You can install "Extended Read Permission" plug-in. Then in either "Global Settings" or in individual job configuration, you can give the user "Extended Read" permission.

answered Aug 28 '14 at 12:01

Rahul Singhai

1,299
15
27

score 0 · Answer 7 · answered Dec 01 '11 at 21:10

0

Try going to "Manage Jenkins"->"Manage Users" go to the specific user, edit his/her configuration "My Views section" default view.

answered Dec 01 '11 at 21:10

jordilin

25
2

8

This only hides the job from the user, it doesn't prevent access to it. – stwalkerster Jan 18 '13 at 12:50

Restricting visibility of Jenkins jobs to specific users

7 Answers7

Linked