15

Some jobs push to QA and some jobs push to Production.

Only devs should be allowed to push to QA and only QA should be allowed to push to production. Aside from making two separate build servers (with some way to share artifacts) how do I restrict permissions?

5 Answers 5

19

You need Project-based Matrix Authorization Strategy in Global Configuration, and on the Job Configuration, use Enable Project-based Security.

It's all explained here
Standard Security Explained

2
  • The link is now broken. Is Gareth's link now the relevant one? Apr 9, 2015 at 8:24
  • @TomislavNakic-Alfirevic Gareth's link explains the individual permissions of matrix-based security. My link explains how to setup matrix-based security. I've added a new link, since the original appears to have moved. Thanks
    – Slav
    Apr 9, 2015 at 12:53
10

You have to manage restrictions with the tools that Jenkins provides. If you have administrator status go to "Jenkins configuration" (picture 1) and then to "Manage and assign roles" (picture 2). Here you will see "Manage roles" and "Assign roles".

Access to jenkins configuration from dashboard Jenkins manage and assign roles enter image description here

Use "Manage roles" to create/update roles and assign permissions to determined projects and also to manage the restrictions of each job. Use "Manage and Assign roles" to assign roles to users or to other groups.

Role/permission matrix:

Permission matrix for Jenkins

Thus you can configure groups to administrate determined jobs, to execute other jobs or to simply have the ability to visit and see job details.

3

You can use matrix-based security to achieve this.

3
  • In the document you sent, it lists build as permission to "Start a new build." I may be blind, but where is the start a new build permission for individual jobs? edit: Ah, so this is a feature of project based matrix security, then?
    – diadem
    Aug 29, 2014 at 23:08
  • Yes, project based matrix security lets you assign the "start new build" permission for individual jobs. Job and project are synonyms in Jenkins. Aug 30, 2014 at 22:06
  • Using the OP's example, assume there is a DeployToQA job and a DeployToProd job, where developers should not be able to execute the DeployToProd job. Can you make that happen using matrix-based security?
    – alex
    Jun 11, 2018 at 17:05
2
  1. Make sure the user account is created
  2. Do not add that user to the global configuration security but do have project matrix enabled security enabled and authenticated users read access
  3. Now go to the job and add that user and choose read.

  4. You can now see that the user has only access to that specific job

0

I just found the ownership based security method for doing per-job and per-node permissions. Not applicable in all situations but sometimes very useful - like when other teams are running few jobs on your team's instance.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.