Allow users without global Job/Build permission configure multibranch jobs #156

mymarche · 2021-08-12T21:20:47Z

Hello!

If somebody install gitlab-branch-source-plugin with authorization plugin (like Folder Authorization Plugin or Role-based Authorization Strategy), they might grant permission Job/Build on certain jobs without granting global permission Job/Build.
In this case, user with this permissions will get error:

hudson.security.AccessDeniedException3: <username> is missing the Job/Build permission
  at hudson.security.ACL.checkPermission(ACL.java:79)
  at hudson.security.AccessControlled.checkPermission(AccessControlled.java:47)
  at io.jenkins.plugins.gitlabserverconfig.servers.GitLabServer.getCredentials(GitLabServer.java:229)
  at io.jenkins.plugins.gitlabbranchsource.helpers.GitLabHelper.apiBuilder(GitLabHelper.java:25)
  at io.jenkins.plugins.gitlabbranchsource.GitLabSCMSource$DescriptorImpl.doFillProjectPathItems(GitLabSCMSource.java:843)
  at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:710)
  at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:396)
Caused: java.lang.reflect.InvocationTargetException
...

This caused by check permission onli on Jenkins singleton in this line:

gitlab-branch-source-plugin/src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java

Line 229 in ae2e6e7

jenkins.checkPermission(CredentialsProvider.USE_OWN);

Documetation said:

Identify the nearest AccessControlled objects to check permissions with. If your 'this' object is already access-controlled, then that’s obviously it. Otherwise, try to look for the nearest logical ancestor. If all else fails, use the Jenkins singleton.

In this PR I try to fix AccessDeniedException by:

Identify AccessControlled objects in methods which use static method apiBuilder()
Pass this objects in apiBuilder() and getCredentials()
Check permission on this objects or on Jenkins singleton if they is null in getCredentials().

Fixes:
JENKINS-62478

justinharringa · 2021-08-17T19:11:06Z

@LinuxSuRen @jetersen @MarkEWaite this seems to look good but I wonder if someone in the security SIG should give it a once-over?

moshavnik · 2021-08-23T06:46:01Z

@LinuxSuRen , can you speed up the merge of this PR?
is there anything we can do to help with process?

mymarche · 2021-08-26T08:12:10Z

@baymac Hi! maybe you can help us with review this PR?

moshavnik · 2021-08-26T11:22:42Z

I don't think baymac is relevant... he doesn't respond to anything for the past couple of years... if any, I think we can ask the updaters in the jira issue to review it and tell if it is working for them. I simply installed it on a test environment and checked the flow I reported in the jira issue.

…

On Thu, Aug 26, 2021 at 11:12 AM Mikhail Marchenko ***@***.***> wrote: @baymac <https://github.com/baymac> Hi! maybe you can help to us with review this PR? — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#156 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABEIBU5VAIC37UX4LDVEBKTT6XZOLANCNFSM5CCGHFMA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email> .

justinharringa · 2021-08-26T19:25:23Z

If folks are interested in helping to maintain the plugin and its tests, you might consider becoming a maintainer. I personally don't have enough time to dedicate here (and I also don't really use GitLab), unfortunately, and it seems @baymac (who did great work here) doesn't have enough time these days either.

Hope you are all well.

mymarche · 2021-09-02T07:43:15Z

@LinuxSuRen Hi! Could you please merge this PR if you are fine with the changes?

shelene31400 · 2021-09-22T15:24:57Z

Hello, I'm also having this problem, it would be nice if the PR is accepted :)

MarkEWaite · 2021-09-22T15:51:23Z

@shelene31400 one of the most persuasive arguments to a plugin maintainer is when a user says, "I'm using this in production and it works the way I expected". You can provide that persuasion by installing the 'hpi' file into your Jenkins controller from https://ci.jenkins.io/job/Plugins/job/gitlab-branch-source-plugin/job/PR-156/ . Look for the most recent successful artifacts and find the '.hpi' file. Install that using the "Advanced" settings in the plugin manager.

If you're using a 'plugins.txt' file to manage your plugin versions as code, then you can use the 'incrementals' syntax to use that version. See https://github.com/MarkEWaite/docker-lfs/blob/4b0981a8e6689cca50f2cdfd8723e30f8d4fcaec/plugins.txt#L49 for one example.

bitnik · 2021-09-28T13:20:23Z

You can provide that persuasion by installing the 'hpi' file into your Jenkins controller from https://ci.jenkins.io/job/Plugins/job/gitlab-branch-source-plugin/job/PR-156/ . Look for the most recent successful artifacts and find the '.hpji' file. Install that using the "Advanced" settings in the plugin manager.

@MarkEWaite by following this, our jenkins admin installed the plugin on this PR. Then I tested it and now I can confirm that now I can configure a multibranch pipeline without global permissions, which I couldn't before.

ohartl · 2021-09-30T12:13:12Z

You can provide that persuasion by installing the 'hpi' file into your Jenkins controller from https://ci.jenkins.io/job/Plugins/job/gitlab-branch-source-plugin/job/PR-156/ . Look for the most recent successful artifacts and find the '.hpji' file. Install that using the "Advanced" settings in the plugin manager.

@MarkEWaite by following this, our jenkins admin installed the plugin on this PR. Then I tested it and now I can confirm that now I can configure a multibranch pipeline without global permissions, which I couldn't before.

Can also verify this PR works, LGTM!!

usinelogicielle · 2021-10-08T12:24:14Z

Hello, I confirm that the PR solve the problem. Our Admin installed it and we tested the plugin.
We use Jenkins 2.303.1 and GitLab 13.9.7 with PR version of GitLab Branch Source. I can now create jobs without global permissions. We use the Matrix Authorization Strategy plugin for role base authorizations for projects.
@LinuxSuRen @baymac can you please look at this PR? It looks great. Thanks in advance.
We can't wait for PR to be accepted :)

Turiok · 2021-10-14T21:51:06Z

Hi @mymarche,

I would more explanation of this PR.
I tested it and it seems to work. But When I read the source code, I can't understand how.
I think all the modifications are for the method getCredentials() in class GitlabServer l230.
The changes add cases to check if the credential is in a folder level or higher. Not just on the Jenkins level.

But my comprehension of the plugin is that we have to give a credential to access to the Gitlab API when we create the Gitlab server instance in the administration panel. The GitlabServer class. So the jenkins level should be enough and with system scope's too.

But the issue seems to be a problem with the permission of the user who create the multi branch pipeline.
I can't see the link between find a credential in GitlabServer class. And the authorization of the user.

Could you help me to understand?

Kind regards,
Didier

mymarche · 2021-11-17T18:40:04Z

Hi @mymarche,

I would more explanation of this PR. I tested it and it seems to work. But When I read the source code, I can't understand how. I think all the modifications are for the method getCredentials() in class GitlabServer l230. The changes add cases to check if the credential is in a folder level or higher. Not just on the Jenkins level.

But my comprehension of the plugin is that we have to give a credential to access to the Gitlab API when we create the Gitlab server instance in the administration panel. The GitlabServer class. So the jenkins level should be enough and with system scope's too.

But the issue seems to be a problem with the permission of the user who create the multi branch pipeline. I can't see the link between find a credential in GitlabServer class. And the authorization of the user.

Could you help me to understand?

Kind regards, Didier

Hi, @Turiok!

Yes, you absolutly right.
In this places

gitlab-branch-source-plugin/src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java

Line 237 in 7ec1f98

ACL.SYSTEM,

gitlab-branch-source-plugin/src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java

Line 246 in 7ec1f98

ACL.SYSTEM,

gitlab-branch-source-plugin/src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java

Line 253 in 7ec1f98

ACL.SYSTEM,

we need to use Jenkins.getAuthentication(), but then we cant find any credentials.

Like in this issue: JENKINS-58902

Turiok · 2021-11-17T20:13:44Z

src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java

+                                                                                                    fromUri(defaultIfBlank(serverUrl, GITLAB_SERVER_URL)).build()
+                                                                                                ), withId(credentialsId));
+        } else {
+            context.checkPermission(CredentialsProvider.USE_OWN);


Hi, @mymarche ,

Sorry to bothering you again.
I read your comment and read again the source code.
What I understand, This is this specific line which correct the problem right?
At this line Jenkins, or in your case the context of security, check if the user can configure the pipeline or not?

Strange the permission needed is the Job/Build permission and not Job/Configure but it's another problem.

But I don't understand the if else after. The personal access token(PAT) is stocked at the global level, during the creation of the gitlab server in the administration panel, so the old code should be working to find this PAT. Instead, do you try to change the code to find the PAT at folder level too?
It'll be great I think. The possibility to define the gitlab server instance during the creation of the multi branch pipeline.
But is it not another feature? And only with this change it can't work right? Because the creation of a gitlab server instance is only defined in the administration panel and not during the job creation. And to be perfect, regarding the gitlab project isolation easily. It should be Project access token and not Personnal access token.
Am I wrong on the last part or not?

Hi, @Turiok !

At this line Jenkins, or in your case the context of security, check if the user can configure the pipeline or not?

Yes

Am I wrong on the last part or not?

No, you are right.
I created fix only for searching PAT in this case.
I think, define PAT for gitlab server per folder or per job is correct.
But i don't know how to implement it correctly.

usinelogicielle · 2021-12-15T10:29:10Z

Hello @LinuxSuRen @justinharringa @baymac @markyjackson-taulia,

If you have a little time, it would be nice to watch this PR. This is really a crucial feature for the plugin. We tested this PR on our side and it works. We have also analyzed the code modification and it does not bring any security issue.
I think it is also a highly requested feature by many people here.

Thanks in advance :)

jetersen · 2022-04-18T08:32:24Z

@mymarche would you be able to fix the conflicts and ping me once the PR is ready for review 😄

… jobs

mymarche · 2022-04-23T14:51:17Z

@jetersen ping :)
Can you review this PR?

.gitignore

jetersen · 2022-04-23T19:16:52Z

Released in https://github.com/jenkinsci/gitlab-branch-source-plugin/releases/tag/625.v85cf3a_400cfe

ipleten · 2022-06-21T01:01:57Z

I suspect this changes require to move token from System to Global Scope. At least it started working when i did it migrating from 1.5.9.

usinelogicielle · 2022-06-21T12:17:08Z

Hi @ipleten

We see this issue since a long time. I'm not remember if it's before or after this PR.
It's described here : #161

ipleten · 2022-06-21T14:40:51Z

Just to ensure we are on the same page.
We have multiply Jenkins installation with different plugin versions and I can confirm that v1.5.9 works with System Global creds the current version works only with Global Scope which causes security concerns (as now all jobs can obtain token)

moshavnik · 2022-07-08T22:12:32Z

I suspect this changes require to move token from System to Global Scope. At least it started working when i did it migrating from 1.5.9.

this implementation is very problematic since it exposes the token of the entire gitlab server to all the jobs. this poses a great security breach.
i opened a bug about this, here.

mymarche changed the title ~~Bugfix: Allow users without global Job/Build permission configure multibranch jobs~~ Allow users without global Job/Build permission configure multibranch jobs Aug 12, 2021

mymarche marked this pull request as draft August 13, 2021 11:43

mymarche marked this pull request as ready for review August 13, 2021 15:03

Turiok reviewed Nov 17, 2021

View reviewed changes

mymarche added 2 commits April 23, 2022 17:31

Allow users without global Job/Build permission configure multibranch…

48afdc5

… jobs

fix: AccessControlled can be ItemGroup and Item

5efe7d7

jetersen added the enhancement New feature or request label Apr 23, 2022

jetersen approved these changes Apr 23, 2022

View reviewed changes

.gitignore Outdated Show resolved Hide resolved

Update .gitignore

ab6a64b

jetersen merged commit 85cf3a4 into jenkinsci:master Apr 23, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow users without global Job/Build permission configure multibranch jobs #156

Allow users without global Job/Build permission configure multibranch jobs #156

mymarche commented Aug 12, 2021

justinharringa commented Aug 17, 2021

moshavnik commented Aug 23, 2021

mymarche commented Aug 26, 2021 •

edited

moshavnik commented Aug 26, 2021 via email

justinharringa commented Aug 26, 2021

mymarche commented Sep 2, 2021

shelene31400 commented Sep 22, 2021

MarkEWaite commented Sep 22, 2021 •

edited

bitnik commented Sep 28, 2021

ohartl commented Sep 30, 2021

usinelogicielle commented Oct 8, 2021

Turiok commented Oct 14, 2021

mymarche commented Nov 17, 2021

Turiok Nov 17, 2021 •

edited

mymarche Nov 26, 2021 •

edited

usinelogicielle commented Dec 15, 2021

jetersen commented Apr 18, 2022

mymarche commented Apr 23, 2022

jetersen commented Apr 23, 2022

ipleten commented Jun 21, 2022

usinelogicielle commented Jun 21, 2022

ipleten commented Jun 21, 2022 •

edited

moshavnik commented Jul 8, 2022

Allow users without global Job/Build permission configure multibranch jobs #156

Allow users without global Job/Build permission configure multibranch jobs #156

Conversation

mymarche commented Aug 12, 2021

justinharringa commented Aug 17, 2021

moshavnik commented Aug 23, 2021

mymarche commented Aug 26, 2021 • edited

moshavnik commented Aug 26, 2021 via email

justinharringa commented Aug 26, 2021

mymarche commented Sep 2, 2021

shelene31400 commented Sep 22, 2021

MarkEWaite commented Sep 22, 2021 • edited

bitnik commented Sep 28, 2021

ohartl commented Sep 30, 2021

usinelogicielle commented Oct 8, 2021

Turiok commented Oct 14, 2021

mymarche commented Nov 17, 2021

Turiok Nov 17, 2021 • edited

Choose a reason for hiding this comment

mymarche Nov 26, 2021 • edited

Choose a reason for hiding this comment

usinelogicielle commented Dec 15, 2021

jetersen commented Apr 18, 2022

mymarche commented Apr 23, 2022

jetersen commented Apr 23, 2022

ipleten commented Jun 21, 2022

usinelogicielle commented Jun 21, 2022

ipleten commented Jun 21, 2022 • edited

moshavnik commented Jul 8, 2022

mymarche commented Aug 26, 2021 •

edited

MarkEWaite commented Sep 22, 2021 •

edited

Turiok Nov 17, 2021 •

edited

mymarche Nov 26, 2021 •

edited

ipleten commented Jun 21, 2022 •

edited