Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are running a Jenkins CI. Generally we would like to provide

  1. full access to authenticated users from particular group
  2. full-read access to anonymous users
  3. block anonymous users to access certain projects (completely)

We use Unix user/group database and Project-based Matrix Authorization Strategy. Points (1) and (2) works well but we are having trouble achieving (3).

We have tried:

  • in Global Security removing all rights to anonymous and then granting it in project-based security but after that all anonymous requests (even to main Jenkins page) yields login page
  • in Global Security adding in steps following rights: View-Read (didn't work), Job-Discover (didn't work), Job-Read (didn't work), Overal-Read - this last one seemed to work however it gave the anonymous user too much rights and we weren't able to limit access to the particular project.


we want fully open (read-wise) Jenkins CI with a few projects completely hidden/blocked for anonymous.

share|improve this question
up vote 9 down vote accepted

OK, so I've managed to do it:

  • you need Role Strategy Plugin
  • enable this authentication strategy in Configure Global Security
  • in Manage and Assign Roles / Manage Roles create new role anonymous and authenticated for both global and project roles
  • in Global roles grant anonymous role right only to Overall / Read (this will at the very least access anonymous user main jenkins screen with navigation and link to login page, not login prompt immediately)
  • in Project role add anonymous role with regexp pattern that will match projects you want anonymous users to access and after adding this role grant it right to Job / Read and Job / Discover
  • navigate to Manage and Assign Roles / Assign Roles and assign Anonymous user group to anonymous role (and authenticated users to specific groups). SAVE
share|improve this answer
A related gotcha is that the role strategy is case sensitive in matching user names. I had entered uppercase user names on the "Assign Roles" page. I logged in with lower case username and even though my username is displayed in uppercase, no roles matched my user. My allowable permissions fell back to that of anonymous user. If I log in with uppercase username, it works. – s_t_e_v_e May 23 '13 at 20:31
While this answer works, you ever explained the purpose or configuration of the "authenticated" role. – Brad Wood May 30 '14 at 16:16
that's just a shortcut - it can be "anonymous" and "priviliged"; I used "authenticated" because the subset of folks available to view and edit those particular hidden tasks would be equal to those that actually have the account. – Wojtek May 30 '14 at 19:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.