5

Any time I authenticate a system with LDAP/AD I like to have at least one "local" admin that can get in even if Directory Services go down/have an issue. Essentially a "backdoor" just in case the directory service has an issue.

Is this possible in Jenkins? I can only see the option to enable 1 authentication method at a time.

6

You're right that vanilla Jenkins can't do more than one authn/authz type, which makes local accounts infeasible. In the scenario where LDAP is unavailable temporarily, what I've done in the past is shut down Jenkins, disable authn/authz via editing Jenkins' config.xml (on my Linux systems the full path is /var/lib/jenkins/config.xml), and then restart Jenkins. Specifically, you'll want to change this line:

<useSecurity>true</useSecurity>

To:

<useSecurity>false</useSecurity>

Note that this will give admin access to anonymous users, so use with caution. If you are comfortable with editing XML by hand, it's also possible to edit this file in such a way as to allow admin access via logging in with a local account.

You can also do any of this with a Groovy script if you happen to have an active session with administrative permissions.

  • I just tested this method and it works. Not pretty but it works. Thanks. – emmdee Nov 28 '17 at 17:01
  • 1
    You're definitely right that it's an ugly solution, and I would only really recommend it when it's absolutely necessary. I updated my answer with a little bit more detail in case it's useful to any future visitors. – jayhendren Nov 28 '17 at 17:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.