3

I'm trying to disable Anonymous access to our Jenkins installation, but still allow Codebase Git to perform post-receive hooks to post to Jenkins, to allow it to trigger a build.

We're using Matrix-based security, and have allowed only the following permissions for Anonymous users:

  • Overall > Read
  • Job > Read
  • Job > Build

These are the minimum I have to activate in order to get Codebase posting the URL, otherwise I get access denied errors from Jenkins, the problem is, it allows anonymous users to browse our projects?

Is there a way to obscure this? I think it's really stupid that Jenkins needs Overall > Read access to allow the Job > Build permission to work.

Improve this question

1 Answer 1

Reset to default
1

This is how we do:

You can make a new user called github for an example and give it the same three permissions, then when you link to the build url you include the username and password in the url, like:

http://USER:PASS@jenkins_url/job/JOBNAME/build

This way you do not allow anonymous user access your Jenkins instance.

Improve this answer
2
  • There's apparently now an API token that prevents you from having to reveal your real password. To quote from their site, "Specifying the real password is still supported after 1.426, but it is not recommended because the risk of revealing password, and the human tendency to reuse the same password in different places." wiki.jenkins-ci.org/display/JENKINS/…
    – Katherine Villyard
    Mar 4, 2014 at 23:29
  • Yes, that is right, but you would create a user with the minimal access abilities, and hopefully with a unique password, when you want to use webhooks. But a good idea if you want to use your own account :)
    – Kevin Simper
    Mar 5, 2014 at 11:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .