[JENKINS-2324] Feature - Set read permission by project for project-based security

[jenkins-infra-bot]

We'd like to use hudson for different projects with different team members,
which only should see the projects in which they work, not all projects.

We use the user directory from hudson itself and the "Project-based Matrix
Authorization Strategy"...

---

Originally reported by klattenhoff, imported from: Feature - Set read permission by project for project-based security

• assignee: adphillips
• status: Resolved
• priority: Critical
• component(s): _unsorted
• resolution: Fixed
• resolved: 2014-01-14T12:30:45+00:00
• votes: 0
• watchers: 2
• imported: 2025-12-08

Raw content of original issue

We'd like to use hudson for different projects with different team members,
which only should see the projects in which they work, not all projects.

We use the user directory from hudson itself and the "Project-based Matrix
Authorization Strategy"...

• environment: Platform: All, OS: All

2 attachments

• read-perm-v2.patch
• read-perm.patch

[jenkins-infra-bot]

adphillips:

• Original comment link
• Raw content of original comment:

  I am implementing READ permission at the job level.  
  When this is done, a user that lacks the READ permission for a particular job
  will not:
  
  	
  see that job in any view
  	
  be able to access the job page directly
  	
  see any reference to the job (for instance in upstream or downstream dependencies)
  
  
  
  There is a related forum post where I am looking for feedback on what ACLs to
  use: http://www.nabble.com/Read-permission-on-Jobs-td20650539.html
  

I am implementing READ permission at the job level.
When this is done, a user that lacks the READ permission for a particular job
will not:

• see that job in any view
• be able to access the job page directly
• see any reference to the job (for instance in upstream or downstream dependencies)

There is a related forum post where I am looking for feedback on what ACLs to
use: http://www.nabble.com/Read-permission-on-Jobs-td20650539.html

[jenkins-infra-bot]

adphillips:

• Original comment link
• Raw content of original comment:

  Reassigned issue to myself
  

Reassigned issue to myself

[jenkins-infra-bot]

adphillips:

• Original comment link
• Raw content of original comment:

  fix in progress, waiting on feedback on what to do about SYSTEM authentication.
  See this thread: http://www.nabble.com/SYSTEM-authentication-td20988049.html
  

fix in progress, waiting on feedback on what to do about SYSTEM authentication.
See this thread: http://www.nabble.com/SYSTEM-authentication-td20988049.html

[jenkins-infra-bot]

adphillips:

• Original comment link
• Raw content of original comment:

  Created an attachment (id=477)
  READ permissions patch
  

Created an attachment (id=477)
READ permissions patch

[jenkins-infra-bot]

adphillips:

• Original comment link
• Raw content of original comment:

  See attached patch file...
  
  This patch provides the ability to hide jobs from the view of certain users
  (including anonymous).  The Co
  nfigure System page in Manage Hudson now will display a READ permission under
  the Job heading.  If not che
  cked, the user will be denied access to the job in the following ways:
  
  	
  the job will not be visible in any views
  	
  upstream and downstream dependencies referencing this job will be hidden
  	
  the job will not be accessable by a direct URL reference (404 will occur)
  	
  if the job is scheduled to be built, it will show up as "Unknown Task" in the
  build queue
  	
  the job will also show as "Unkown Task" in the Build Executor when the job is
  building
  
  
  
  
  Files Changed:
  
  Set authentication to SYSTEM in the following processes:
  
  	
  WebAppMain "hudson initialization thread"
  	
  Hudson constructor
  	
  Trigger.Cron threads
  
  
  
  AbstractProject.java:
  
  	
  Updated deprecated permissions checks
  
  
  
  Hudson.java:
  
  	
  retrieval of Items is now access controlled. Only readable items are returned.
  
  
  
  Item.java:
  
  	
  added READ permission oject
  
  
  
  GlobalMatrixAuthorizationStrategy.java:
  
  	
  removed unused private method readResolve.  It appears this is a left-over
  from an old ACL implementatio
  n
  
  
  

See attached patch file...

This patch provides the ability to hide jobs from the view of certain users
(including anonymous). The Co
nfigure System page in Manage Hudson now will display a READ permission under
the Job heading. If not che
cked, the user will be denied access to the job in the following ways:

• the job will not be visible in any views
• upstream and downstream dependencies referencing this job will be hidden
• the job will not be accessable by a direct URL reference (404 will occur)
• if the job is scheduled to be built, it will show up as "Unknown Task" in the
  build queue
• the job will also show as "Unkown Task" in the Build Executor when the job is
  building

Files Changed:

Set authentication to SYSTEM in the following processes:

• WebAppMain "hudson initialization thread"
• Hudson constructor
• Trigger.Cron threads

AbstractProject.java:

• Updated deprecated permissions checks

Hudson.java:

• retrieval of Items is now access controlled. Only readable items are returned.

Item.java:

• added READ permission oject

GlobalMatrixAuthorizationStrategy.java:

• removed unused private method readResolve. It appears this is a left-over
  from an old ACL implementatio
  n

[jenkins-infra-bot]

adphillips:

• Original comment link
• Raw content of original comment:

  changing issue type to PATCH
  

changing issue type to PATCH

[jenkins-infra-bot]

petehayes:

• Original comment link
• Raw content of original comment:

  Any progress lately?  I'd really like to see this enhancement,
  

Any progress lately? I'd really like to see this enhancement,

[jenkins-infra-bot]

mindless:

• Original comment link
• Raw content of original comment:

  
  	
  
  	
  
  		
  
  		
  
  			
  Issue 2993 has been marked as a duplicate of this issue. ***
  		
  		
  	
  	
  
  
  

• • • Issue 2993 has been marked as a duplicate of this issue. ***

[jenkins-infra-bot]

kunzstefan:

• Original comment link
• Raw content of original comment:

  Are there any plans to integrate this patch in the hudson deployment?
  

Are there any plans to integrate this patch in the hudson deployment?

[jenkins-infra-bot]

huybrechts:

• Original comment link
• Raw content of original comment:

  
  	
  
  	
  
  		
  
  		
  
  			
  Issue 3108 has been marked as a duplicate of this issue. ***
  		
  		
  	
  	
  
  
  

• • • Issue 3108 has been marked as a duplicate of this issue. ***

[jenkins-infra-bot]

mindless:

• Original comment link
• Raw content of original comment:

  
  	
  
  	
  
  		
  
  		
  
  			
  Issue 3243 has been marked as a duplicate of this issue. ***
  		
  		
  	
  	
  
  
  

• • • Issue 3243 has been marked as a duplicate of this issue. ***

[jenkins-infra-bot]

adphillips:

• Original comment link
• Raw content of original comment:

  It's great to see so much interest in this.  I will generate a new patch and see
  if we can get this introduced into hudson core.
  

It's great to see so much interest in this. I will generate a new patch and see
if we can get this introduced into hudson core.

[jenkins-infra-bot]

hdenk:

• Original comment link
• Raw content of original comment:

  my favourite issue  nice to see it STARTED
  
  this is another usecase for it:
  
  we have a release-process with the roles
  'developer' and 'buildmanager' and we do builds for
  integration and release in different jobs. developers should
  not see the release-build-jobs and the buildmanager wants
  not see integration-build-jobs.
  

my favourite issue nice to see it STARTED

this is another usecase for it:

we have a release-process with the roles
'developer' and 'buildmanager' and we do builds for
integration and release in different jobs. developers should
not see the release-build-jobs and the buildmanager wants
not see integration-build-jobs.

[jenkins-infra-bot]

mdonohue:

• Original comment link
• Raw content of original comment:

  simplify the summary
  

simplify the summary

[jenkins-infra-bot]

adphillips:

• Original comment link
• Raw content of original comment:

  Created an attachment (id=669)
  updated patch to work with hudson 1.300-SNAPSOT
  

Created an attachment (id=669)
updated patch to work with hudson 1.300-SNAPSOT