52

I don't know why "logged in users can do anything" means Jenkins will happily allow non-authenticated users to view project details and access artifacts... Regardless, I need to know how to get Jenkins to allow logged in users to to anything AND hide EVERYTHING for users who AREN'T logged in. Help please?

3
  • 11
    Jenkins security architecture is shameful Apr 25, 2015 at 12:03
  • 3
    Eactly my question what kind of security is this ? May 20, 2016 at 10:24
  • Anyone know how to do this with SAML and SSO?
    – Princy
    Apr 22, 2022 at 17:03

4 Answers 4

79

This can be done with the Role-Strategy plugin.

Install the plugin, add a new group called "Anonymous" and uncheck everything. Then you want to add another group called "authenticated" and check everything. Add your existing users to this group. Jenkins will immediately prompt you for a login this way.

8
  • 2
    I had added "Authenticated" (upper-case), it does not work. Thanks, thanks!
    – iurisilvio
    Jul 17, 2014 at 19:23
  • 14
    To be clear, this is for the Role-Strategy plugin (wiki.jenkins-ci.org/display/JENKINS/Role+Strategy+Plugin) - not default Jenkins. Works nicely! Jan 9, 2015 at 11:06
  • It would be nice if this answer was edited to add the plugin. Jan 13, 2016 at 16:34
  • I added roles Authenticated (ticked all rights) and Anonymous (ticked nothing). I did it in upper-case, because I like it that way. I then assigned role Authenticated to my user and assigned role Anonymous to user anonymous. And it DOES work; if not logged in, all you see is a login prompt; and when authenticated, I can do everything. (This plugin ought to be added by default and all the others ditched except maybe "Anyone can do anything"). Jan 19, 2016 at 12:08
  • @StephanHenningsen I tried your steps, but if I do it like this, then i get a Nullpointer when i go to homepage as anonymous (not logged in). Did you counter the same problem? Mar 18, 2016 at 8:16
9

You can use https://wiki.jenkins-ci.org/display/JENKINS/Role+Strategy+Plugin

it allows to specify to define roles and assign roles to users, users with no roles won't even see the jenkins ui.

6

Answer to an old question but I came searching here as I am trying to auto spin up a Jenkins instance on Docker and found the same issue.

Good chance this option wasn't available when the question was asked. As of this moment (v2.222.3 but not sure how far back), it turns out you can do this without installing any additional plugins.

Manually

  • Navigate to Global Security (Jenkins > Manage Jenkins > Global Security)

  • Update the Authorization section to "Logged-in users can do anything".

    UNCHECK Allow anonymous read access

enter image description here

Any unauthenticated access will redirect to login now.

I would note that if you setup Jenkins through the setup wizard then anonymous read access is disabled by default. If you want this behaviour AND want to configure jenkins automatically, read on.

Automated with Docker

My situation is that I wanted to check out my repo, run my compose file and have all my config/users/plugins etc ready to go. Great post here with more detail if interested.

In a nutshell:

Dockerfile

FROM jenkins/jenkins:lts-alpine

# Disable setup wizard since security.groovy creates our user
ENV JAVA_OPTS="-Djenkins.install.runSetupWizard=false"

COPY security.groovy /usr/share/jenkins/ref/init.groovy.d/security.groovy

security.groovy

#!groovy

import jenkins.model.*
import hudson.security.*

def instance = Jenkins.getInstance()

// Create Admin User
def hudsonRealm = new HudsonPrivateSecurityRealm(false)
hudsonRealm.createAccount("admin", "admin") // Dont do this. This is bad
instance.setSecurityRealm(hudsonRealm)

// Set Auth to Full Control Once Logged In and prevent read-only access
def strategy = new FullControlOnceLoggedInAuthorizationStrategy()
strategy.setAllowAnonymousRead(false)
instance.setAuthorizationStrategy(strategy)

instance.save()

In particular, strategy.setAllowAnonymousRead(false) is what's needed

1

Additionally, if you use GitHub as your version control system -- you can use the GitHub OAuth plugin. Once the "Anonymous" reach your page, they will be redirected to GitHub automatically.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.