├── .mvn ├── maven.config └── extensions.xml ├── src ├── test │ ├── resources │ │ ├── org │ │ │ └── jenkinsci │ │ │ │ └── plugins │ │ │ │ └── matrixauth │ │ │ │ ├── AmbiguityTest │ │ │ │ ├── testDataFrom2xDeletion │ │ │ │ │ ├── jobs │ │ │ │ │ │ └── F │ │ │ │ │ │ │ ├── jobs │ │ │ │ │ │ │ └── fs │ │ │ │ │ │ │ │ ├── builds │ │ │ │ │ │ │ │ ├── legacyIds │ │ │ │ │ │ │ │ └── permalinks │ │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ ├── users │ │ │ │ │ │ ├── users.xml │ │ │ │ │ │ ├── user_5543844453642095256 │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ │ └── admin_7258660542409517449 │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ ├── nodes │ │ │ │ │ │ └── a1 │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ └── config.xml │ │ │ │ └── testDataFrom2xReconfiguration │ │ │ │ │ ├── jobs │ │ │ │ │ └── F │ │ │ │ │ │ ├── jobs │ │ │ │ │ │ └── fs │ │ │ │ │ │ │ ├── builds │ │ │ │ │ │ │ ├── legacyIds │ │ │ │ │ │ │ └── permalinks │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ │ └── config.xml │ │ │ │ │ ├── users │ │ │ │ │ ├── users.xml │ │ │ │ │ ├── admin_7258660542409517449 │ │ │ │ │ │ └── config.xml │ │ │ │ │ └── user_5543844453642095256 │ │ │ │ │ │ └── config.xml │ │ │ │ │ ├── nodes │ │ │ │ │ └── a1 │ │ │ │ │ │ └── config.xml │ │ │ │ │ └── config.xml │ │ │ │ ├── AuthorizationContainerDescriptorTest.properties │ │ │ │ ├── integrations │ │ │ │ └── casc │ │ │ │ │ ├── ExportTest │ │ │ │ │ ├── ExportTest-exportTest-node.yml │ │ │ │ │ ├── ExportTest-exportTestLegacy-node.yml │ │ │ │ │ ├── ExportTest-exportTest-global.yml │ │ │ │ │ ├── ExportTest-exportTestLegacy-global.yml │ │ │ │ │ ├── exportTestLegacy │ │ │ │ │ │ ├── nodes │ │ │ │ │ │ │ └── agent1 │ │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ │ └── config.xml │ │ │ │ │ └── exportTest │ │ │ │ │ │ ├── nodes │ │ │ │ │ │ └── agent1 │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ │ └── config.xml │ │ │ │ │ ├── configuration-as-code-v1.yml │ │ │ │ │ ├── configuration-as-code-v2-ambiguous.yml │ │ │ │ │ ├── configuration-as-code-v2.yml │ │ │ │ │ └── configuration-as-code-v3.yml │ │ │ │ └── inheritance │ │ │ │ └── InheritanceMigrationTest │ │ │ │ ├── jobs │ │ │ │ ├── folder │ │ │ │ │ ├── jobs │ │ │ │ │ │ └── inheritNone │ │ │ │ │ │ │ └── config.xml │ │ │ │ │ └── config.xml │ │ │ │ ├── job │ │ │ │ │ └── config.xml │ │ │ │ └── folder1 │ │ │ │ │ └── config.xml │ │ │ │ ├── users │ │ │ │ ├── bob │ │ │ │ │ └── config.xml │ │ │ │ ├── admin │ │ │ │ │ └── config.xml │ │ │ │ └── alice │ │ │ │ │ └── config.xml │ │ │ │ └── config.xml │ │ └── hudson │ │ │ └── security │ │ │ └── ProjectMatrixAuthorizationStrategyTest │ │ │ ├── JENKINS-58703.xml │ │ │ ├── loadEmptyAuthorizationStrategy │ │ │ └── config.xml │ │ │ └── loadFilledAuthorizationStrategy │ │ │ └── config.xml │ └── java │ │ ├── hudson │ │ └── security │ │ │ └── Security410Test.java │ │ └── org │ │ └── jenkinsci │ │ └── plugins │ │ └── matrixauth │ │ ├── Jenkins57313Test.java │ │ ├── PermissionAdderTest.java │ │ ├── AuthorizationContainerDescriptorTest.java │ │ └── AuthorizationMatrixNodePropertyTest.java └── main │ ├── resources │ ├── hudson │ │ └── security │ │ │ ├── AuthorizationMatrixProperty │ │ │ ├── config_de.properties │ │ │ ├── config_zh_CN.properties │ │ │ ├── config_fr.properties │ │ │ ├── config.groovy │ │ │ ├── config_es.properties │ │ │ ├── config_da.properties │ │ │ ├── config_zh_TW.properties │ │ │ ├── config_tr.properties │ │ │ ├── config_pt_BR.properties │ │ │ └── config_ja.properties │ │ │ ├── GlobalMatrixAuthorizationStrategy │ │ │ ├── help-user-group_zh_TW.jelly │ │ │ ├── help-user-group.jelly │ │ │ ├── help-grantedPermissions.html │ │ │ ├── help_zh_CN.html │ │ │ ├── help-permissions.html │ │ │ ├── help-user-group_ja.jelly │ │ │ ├── help_zh_TW.html │ │ │ ├── help_ja.html │ │ │ ├── help.html │ │ │ ├── help_ru.html │ │ │ ├── help_de.html │ │ │ ├── help_pt_BR.html │ │ │ ├── config.properties │ │ │ ├── help_tr.html │ │ │ ├── help_fr.html │ │ │ ├── config_nb_NO.properties │ │ │ ├── config_fi.properties │ │ │ ├── config_tr.properties │ │ │ ├── config_es.properties │ │ │ ├── config_da.properties │ │ │ ├── config_pt_BR.properties │ │ │ ├── config_nl.properties │ │ │ ├── config_sv_SE.properties │ │ │ ├── config_fr.properties │ │ │ ├── config_de.properties │ │ │ ├── config_zh_CN.properties │ │ │ ├── config_zh_TW.properties │ │ │ ├── config_ja.properties │ │ │ └── config_ru.properties │ │ │ ├── ProjectMatrixAuthorizationStrategy │ │ │ ├── help_zh_CN.html │ │ │ ├── help_zh_TW.html │ │ │ ├── help_ja.html │ │ │ ├── help.html │ │ │ ├── help-grantedPermissions.html │ │ │ ├── help-permissions.html │ │ │ └── help_de.html │ │ │ └── table.css │ ├── index.jelly │ ├── org │ │ └── jenkinsci │ │ │ └── plugins │ │ │ └── matrixauth │ │ │ ├── inheritance │ │ │ ├── Messages.properties │ │ │ ├── InheritGlobalStrategy │ │ │ │ ├── config.properties │ │ │ │ └── config.jelly │ │ │ ├── InheritParentStrategy │ │ │ │ ├── config.properties │ │ │ │ └── config.jelly │ │ │ ├── NonInheritingStrategy │ │ │ │ ├── config.properties │ │ │ │ └── config.jelly │ │ │ └── InheritanceStrategy │ │ │ │ └── config.jelly │ │ │ ├── AmbiguityMonitor │ │ │ ├── index.properties │ │ │ ├── GlobalConfigurationContributor │ │ │ │ └── entries.jelly │ │ │ ├── message.properties │ │ │ ├── message.jelly │ │ │ ├── JobContributor │ │ │ │ └── entries.jelly │ │ │ ├── NodeContributor │ │ │ │ └── entries.jelly │ │ │ └── index.jelly │ │ │ ├── AuthorizationMatrixNodeProperty │ │ │ └── config.groovy │ │ │ ├── Messages_tr.properties │ │ │ ├── Messages_nl.properties │ │ │ ├── Messages_pt_BR.properties │ │ │ ├── Messages_da.properties │ │ │ ├── Messages_de.properties │ │ │ ├── Messages_es.properties │ │ │ ├── Messages_zh_CN.properties │ │ │ ├── Messages_zh_TW.properties │ │ │ ├── Messages_ru.properties │ │ │ ├── Messages_fr.properties │ │ │ ├── Messages_ja.properties │ │ │ └── Messages.properties │ ├── images │ │ └── symbols │ │ │ ├── unselect-all.svg │ │ │ └── select-all.svg │ └── com │ │ └── cloudbees │ │ └── hudson │ │ └── plugins │ │ └── folder │ │ └── properties │ │ ├── AuthorizationMatrixProperty │ │ └── config.groovy │ │ └── FolderContributor │ │ └── entries.jelly │ └── java │ ├── com │ └── cloudbees │ │ └── hudson │ │ └── plugins │ │ └── folder │ │ └── properties │ │ └── OptionalMarker.java │ └── org │ └── jenkinsci │ └── plugins │ └── matrixauth │ ├── AuthorizationType.java │ ├── inheritance │ ├── InheritanceStrategyDescriptor.java │ ├── InheritanceStrategy.java │ ├── InheritParentStrategy.java │ └── InheritGlobalStrategy.java │ ├── DeprecationUtil.java │ └── integrations │ ├── casc │ ├── GlobalMatrixAuthorizationStrategyConfigurator.java │ ├── ProjectMatrixAuthorizationStrategyConfigurator.java │ ├── AuthorizationMatrixNodePropertyConfigurator.java │ └── PermissionDefinition.java │ └── PermissionFinder.java ├── .github ├── CODEOWNERS ├── workflows │ └── jenkins-security-scan.yml └── dependabot.yml ├── Jenkinsfile ├── .gitignore ├── .git-blame-ignore-revs ├── LICENSE.md ├── README.md └── pom.xml /.mvn/maven.config: -------------------------------------------------------------------------------- 1 | -Pconsume-incrementals 2 | -Pmight-produce-incrementals 3 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/jobs/F/jobs/fs/builds/legacyIds: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AuthorizationContainerDescriptorTest.properties: -------------------------------------------------------------------------------- 1 | Test = Test description -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/jobs/F/jobs/fs/builds/legacyIds: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /.github/CODEOWNERS: -------------------------------------------------------------------------------- 1 | # Limit automatic code review requests to production code changes 2 | /src/main/ @jenkinsci/matrix-auth-plugin-developers 3 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_de.properties: -------------------------------------------------------------------------------- 1 | Enable\ project-based\ security=Projektbasierte Sicherheit aktivieren 2 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_zh_CN.properties: -------------------------------------------------------------------------------- 1 | Enable\ project-based\ security=\u542f\u7528\u9879\u76ee\u5b89\u5168 2 | -------------------------------------------------------------------------------- /src/main/resources/index.jelly: -------------------------------------------------------------------------------- 1 | 2 |
3 | Offers matrix-based security authorization strategies (global and per-project). 4 |
5 | -------------------------------------------------------------------------------- /Jenkinsfile: -------------------------------------------------------------------------------- 1 | buildPlugin(useContainerAgent: true, 2 | configurations: [ 3 | [platform: 'linux', jdk: 25], 4 | [platform: 'windows', jdk: 21], 5 | ]) 6 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_fr.properties: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/jenkinsci/matrix-auth-plugin/HEAD/src/main/resources/hudson/security/AuthorizationMatrixProperty/config_fr.properties -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | target/ 2 | work*/ 3 | 4 | # IntelliJ project files 5 | *.iml 6 | *.ipr 7 | *.iws 8 | .idea/ 9 | 10 | # eclipse project file 11 | .settings 12 | .classpath 13 | .project 14 | build/ 15 | 16 | # VS Code 17 | .vscode/ 18 | 19 | # Mac OS 20 | .DS_Store 21 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/jobs/F/jobs/fs/builds/permalinks: -------------------------------------------------------------------------------- 1 | lastCompletedBuild -1 2 | lastFailedBuild -1 3 | lastStableBuild -1 4 | lastSuccessfulBuild -1 5 | lastUnstableBuild -1 6 | lastUnsuccessfulBuild -1 7 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/jobs/F/jobs/fs/builds/permalinks: -------------------------------------------------------------------------------- 1 | lastCompletedBuild -1 2 | lastFailedBuild -1 3 | lastStableBuild -1 4 | lastSuccessfulBuild -1 5 | lastUnstableBuild -1 6 | lastUnsuccessfulBuild -1 7 | -------------------------------------------------------------------------------- /.git-blame-ignore-revs: -------------------------------------------------------------------------------- 1 | # mvn spotless:apply 2 | 4d0e23d0861ee54bcf40dc3070969584c4eb2de5 3 | 4 | # https://github.com/jenkinsci/matrix-auth-plugin/pull/165 5 | # npx prettier --print-width 999 -w src/main/resources/hudson/security/table.js 6 | b5ff96ff53ffb8f5abef09575acb05c38a17b811 7 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help-user-group_zh_TW.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | 不同的安全性領域對群組名稱有不一樣的慣例。 5 | 最好的方法就是登入後，到診斷頁看您所屬的群組名稱。 6 |
7 | 8 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/ProjectMatrixAuthorizationStrategy/help_zh_CN.html: -------------------------------------------------------------------------------- 1 |
2 | 这个授权模型扩展自"安全矩阵",允许把下面的ACL(访问控制列表)矩阵附加到每个项目定义中(在Job配置页面). 3 | 4 |

5 | 这允许你宣布类似这样的声明"约翰能够访问A,B和C,但是不能访问D." 查看"安全矩阵"的帮助文档来了解安全矩阵. 6 | 7 |

8 | ACL配置是追加的,就是说下面的访问控制会追加到所有的项目配置中。 9 |

10 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/inheritance/Messages.properties: -------------------------------------------------------------------------------- 1 | InheritGlobalStrategy.DisplayName=Inherit globally defined permissions 2 | InheritParentStrategy.DisplayName=Inherit permissions from parent ACL 3 | NonInheritingStrategy.DisplayName=Do not inherit permission grants from other ACLs 4 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritGlobalStrategy/config.properties: -------------------------------------------------------------------------------- 1 | blurb = This object will inherit the global security settings \ 2 | directly, but not any permissions granted in ancestor items, if any. 3 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/ProjectMatrixAuthorizationStrategy/help_zh_TW.html: -------------------------------------------------------------------------------- 1 |
2 | 這是「矩陣型安全性」的擴充，可以分別對專案定義額外的存取控制清單 (ACL) 矩陣 3 | (在作業設定畫面裡調整)。 4 | 5 |

6 | 讓您能做到「Joe 可以看到 A, B, C 專案，但是看不到 D」這種程度的設定。 7 | 可以看看「矩陣型安全性」的說明，了解矩陣型安全性的基本概念。 8 | 9 |

10 | ACL 會逐一累加，所以下列授與的存取權限會影響到每一個專案。 11 |

12 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/ProjectMatrixAuthorizationStrategy/help_ja.html: -------------------------------------------------------------------------------- 1 |
2 | "行列による権限設定"の拡張し、プロジェクト毎に行列による権限設定することができます(ジョブの設定画面で行います)。 3 | 4 |

5 | 例えば、"JoeはプロジェクトA、B、Cにアクセスできるが、Dは参照できない"といったことができます。 6 | 行列による権限設定のコンセプトについては、"行列による権限設定"のヘルプを参照してください。 7 | 8 |

9 | ここで設定した権限は、すべてのプロジェクトの権限に追加されます。 10 |

11 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritParentStrategy/config.properties: -------------------------------------------------------------------------------- 1 | blurb = This item will inherit its parent item''s permissions (in addition to any permissions granted here). \ 2 | If this item is at the top level in Jenkins, it will inherit the global security security settings. 3 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help-user-group.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | Different security realm has different conventions about group names. 5 | The best way to go about it is to login and see what group names you belong to, 6 | by going to this diagnostics page. 7 |
8 | 9 | -------------------------------------------------------------------------------- /.mvn/extensions.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | io.jenkins.tools.incrementals 4 | git-changelist-maven-extension 5 | 1.10 6 | 7 | 8 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/ExportTest/ExportTest-exportTest-node.yml: -------------------------------------------------------------------------------- 1 | entries: 2 | - group: 3 | name: "authenticated" 4 | permissions: 5 | - "Agent/Build" 6 | - "Agent/Configure" 7 | - "Agent/Connect" 8 | - "Agent/Delete" 9 | - "Agent/Disconnect" 10 | - user: 11 | name: "anonymous" 12 | permissions: 13 | - "Agent/Build" 14 | inheritanceStrategy: "inheritingGlobal" 15 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/ExportTest/ExportTest-exportTestLegacy-node.yml: -------------------------------------------------------------------------------- 1 | entries: 2 | - userOrGroup: 3 | name: "anonymous" 4 | permissions: 5 | - "Agent/Build" 6 | - userOrGroup: 7 | name: "authenticated" 8 | permissions: 9 | - "Agent/Build" 10 | - "Agent/Configure" 11 | - "Agent/Connect" 12 | - "Agent/Delete" 13 | - "Agent/Disconnect" 14 | inheritanceStrategy: "inheritingGlobal" 15 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help-grantedPermissions.html: -------------------------------------------------------------------------------- 1 | 2 |
3 | This attribute only exists for compatibility for Configuration as Code YAML files before Matrix Authorization Strategy Plugin 1.4. 4 | Use permissions instead. 5 | Setting both is unsupported and the result undefined. 6 |
7 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help_zh_CN.html: -------------------------------------------------------------------------------- 1 |
2 | 在这种授权模型中,你可以通过一个大的表格来配置什么用户可以做什么事. 3 | 4 |

5 | 每一列代表一个权限.把鼠标移动到权限名称上可以查看更详细的权限说明信息. 6 | 7 |

8 | 每一行代表一个用户或组(通常称为'角色',取决于安全域.),这其中包含特殊用户'anonymous',其代表未登录用户,同样还有'authenticated',其代表所有已认证的用户(也就是除了匿名用户的所有用户.) 9 | 可以使用表格下方的输入框来添加新的用户/组/角色到表格中,并且可以点击[x]图标将其从表格中删除. 10 | 11 |

12 | 权限是追加的,这说明如果一个用户X在A,B,C三个组中,那么X的权限是联合了X,A,B,C和匿名用户的所有权限. 13 |

14 | -------------------------------------------------------------------------------- /.github/workflows/jenkins-security-scan.yml: -------------------------------------------------------------------------------- 1 | name: Jenkins Security Scan 2 | on: 3 | push: 4 | branches: 5 | - main 6 | pull_request: 7 | types: [ opened, synchronize, reopened ] 8 | workflow_dispatch: 9 | 10 | permissions: 11 | security-events: write 12 | contents: read 13 | actions: read 14 | 15 | jobs: 16 | security-scan: 17 | uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2 18 | with: 19 | java-cache: maven 20 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help-permissions.html: -------------------------------------------------------------------------------- 1 | 2 |
3 | A list of strings with the following format: "PermissionGroup/PermissionName:UserOrGroup". 4 | Examples for list entries: 5 | 9 |
10 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help-user-group_ja.jelly: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | ユーザー情報の取得先によってグループ名は異なる記法が使われることがあります。 5 | 最善の方法は、一度ユーザーでログインして、この診断ページに行って実際にJenkinsが使っているグループ名を見ることです。 6 |

7 | 接頭辞である"ROLE_"と大文字であるか小文字であるかを変更するには、Jenkinsのアーカイブに含まれるWEB-INF/security/LDAPBindSecurityRealm.groovyを編集して、 8 | 再起動します。 9 |

10 |
11 | 12 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help_zh_TW.html: -------------------------------------------------------------------------------- 1 |
2 | 在這種配置下，您可以透過一張大表格，設定每個人可以做的每件事。 3 | 4 |

5 | 每一欄都表示一項權限。將滑鼠游標移到權限名稱上，可以看到權限代表的意義說明。 6 | 7 |

8 | 一行就是一個使用者或群組 (依據安全性領域不同，一般也叫做「角色」)。 9 | 包括 "anonymous" 特殊使用者，代表沒有通過驗證的人; 10 | 另外也有 "authenticated"，代表所有驗證通過的人 (換句話說，就是除了匿名使用者以外的所有人)。 11 | 透過表格下方的文字方塊可以新增使用者、群組、角色進來，按一下 [x] 圖示可以把它由表格中移掉。 12 | 13 |

14 | 權限會累加。也就是說，如果 X 使用者在 A, B, C 三個群組中，則該使用者實際的權限會是 X, A, B, C 及匿名使用者權限的聯集。 15 |

16 | -------------------------------------------------------------------------------- /src/main/resources/images/symbols/unselect-all.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/users/users.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 1 4 | 5 | 6 | admin 7 | admin_7258660542409517449 8 | 9 | 10 | user 11 | user_5543844453642095256 12 | 13 | 14 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/users/users.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 1 4 | 5 | 6 | admin 7 | admin_7258660542409517449 8 | 9 | 10 | user 11 | user_5543844453642095256 12 | 13 | 14 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/inheritance/NonInheritingStrategy/config.properties: -------------------------------------------------------------------------------- 1 | blurb = This object will not inherit the global security settings, or any permissions from its ancestors. \ 2 | Only permissions explicitly enabled here will be granted. \ 3 | To ensure that users are not inadvertently locked out from Jenkins, an exception is made for the Overall/Administer permission: \ 4 | Administrators of Jenkins will still have access to this object even if not explicitly granted here. 5 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/ProjectMatrixAuthorizationStrategy/help.html: -------------------------------------------------------------------------------- 1 |
2 | This mode is an extension to "Matrix-based security" that allows additional ACL matrix to be defined 3 | for each project separately (which is done on the job configuration screen.) 4 | 5 |

6 | This allows you to say things like "Joe can access project A, B, and C but he can't see D." 7 | See the help of "Matrix-based security" for the concept of matrix-based security in general. 8 | 9 |

10 | ACLs are additive, so the access rights granted below will be effective for all the projects. 11 |

12 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/ProjectMatrixAuthorizationStrategy/help-grantedPermissions.html: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | This attribute only exists for compatibility for Configuration as Code YAML files before Matrix Authorization Strategy Plugin 1.4. 5 | Use permissions instead. 6 | Setting both is unsupported and the result undefined. 7 |
8 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help_ja.html: -------------------------------------------------------------------------------- 1 |
2 | 大きな表形式で、誰が何をできるのか設定します。 3 | 4 |

5 | 各列はパーミッションを表します。パーミッション名の上にマウスをあわせると、 6 | そのパーミッションの詳細が表示されます。 7 | 8 |

9 | 各行はユーザーかグループ(セキュリティ・レルムでは、'ロール'とも呼ばれます)を表します。 10 | この中には、Jenkinsにログインしていない匿名ユーザーをあらわす特別な「anonymous」と、 11 | また、全てのログイン済みユーザーをあらわす特別な「authenticated」という名前を使うこともできます。 12 | 表の下にあるテキストボックスを使用して、ユーザー/グループ/ロールを表に追加し、 13 | [x] のアイコンをクリックすると、表から削除します。 14 | 15 |

16 | パーミッションは追加式です。つまり、ユーザーXがグループA、B、Cに所属しているなら、 17 | このユーザーが実際に持つパーミッションは、 18 | ユーザーX、グループA、B、Cおよび匿名ユーザーに与えられた全てのパーミッションの和になります。 19 |

20 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/ProjectMatrixAuthorizationStrategy/help-permissions.html: -------------------------------------------------------------------------------- 1 | 2 | 3 |
4 | A list of strings with the following format: "PermissionGroup/PermissionName:UserOrGroup". 5 | Examples for list entries: 6 | 10 |
11 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/AmbiguityMonitor/index.properties: -------------------------------------------------------------------------------- 1 | 2 | blurb = The list below lists configurations with ambiguous permission assignments. \ 3 | This means that permissions would be granted both to users with the specified ID, and groups with the specified name. \ 4 | If the current security realm does not distinguish between user IDs and group names unambiguously, and if users can either choose their own user ID or create new groups, this configuration may allow them to obtain greater permissions. \ 5 | It is recommended that you replace all ambiguous entries with ones that are either explicitly a user or group. 6 | title = Objects with ambiguous permission assignments: 7 | -------------------------------------------------------------------------------- /src/main/resources/images/symbols/select-all.svg: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/AuthorizationMatrixNodeProperty/config.groovy: -------------------------------------------------------------------------------- 1 | package org.jenkinsci.plugins.matrixauth.AuthorizationMatrixNodeProperty 2 | 3 | import lib.FormTagLib 4 | import org.jenkinsci.plugins.matrixauth.inheritance.InheritanceStrategyDescriptor 5 | 6 | def f = namespace(FormTagLib) 7 | def st = namespace("jelly:stapler") 8 | 9 | f.nested { 10 | div { 11 | f.dropdownDescriptorSelector(title: _("Inheritance Strategy"), descriptors: InheritanceStrategyDescriptor.getApplicableDescriptors(my?.class?:hudson.model.Node.class), field: 'inheritanceStrategy') 12 | st.include(class: "hudson.security.GlobalMatrixAuthorizationStrategy", page: "config") 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/ExportTest/ExportTest-exportTest-global.yml: -------------------------------------------------------------------------------- 1 | entries: 2 | - group: 3 | name: "authenticated" 4 | permissions: 5 | - "Agent/Build" 6 | - "Agent/Connect" 7 | - "Agent/Create" 8 | - "Agent/Delete" 9 | - "Agent/Disconnect" 10 | - "Credentials/Create" 11 | - "Credentials/ManageDomains" 12 | - "Credentials/View" 13 | - "Job/Build" 14 | - "Job/Cancel" 15 | - "Job/Configure" 16 | - "Job/Read" 17 | - "Overall/Administer" 18 | - "Run/Delete" 19 | - "Run/Update" 20 | - "View/Configure" 21 | - "View/Delete" 22 | - user: 23 | name: "anonymous" 24 | permissions: 25 | - "Overall/Administer" 26 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/ExportTest/ExportTest-exportTestLegacy-global.yml: -------------------------------------------------------------------------------- 1 | entries: 2 | - userOrGroup: 3 | name: "anonymous" 4 | permissions: 5 | - "Overall/Administer" 6 | - userOrGroup: 7 | name: "authenticated" 8 | permissions: 9 | - "Agent/Build" 10 | - "Agent/Connect" 11 | - "Agent/Create" 12 | - "Agent/Delete" 13 | - "Agent/Disconnect" 14 | - "Credentials/Create" 15 | - "Credentials/ManageDomains" 16 | - "Credentials/View" 17 | - "Job/Build" 18 | - "Job/Cancel" 19 | - "Job/Configure" 20 | - "Job/Read" 21 | - "Overall/Administer" 22 | - "Run/Delete" 23 | - "Run/Update" 24 | - "View/Configure" 25 | - "View/Delete" 26 | -------------------------------------------------------------------------------- /.github/dependabot.yml: -------------------------------------------------------------------------------- 1 | # https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file 2 | --- 3 | version: 2 4 | updates: 5 | - package-ecosystem: "maven" 6 | directory: "/" 7 | schedule: 8 | interval: "weekly" 9 | day: "friday" 10 | ignore: 11 | # BOM and build dependencies are excluded, they are released far too often and matter too little 12 | - dependency-name: "io.jenkins.tools.bom:bom-2.*.x" 13 | - dependency-name: "io.jenkins.tools.incrementals:git-changelist-maven-extension" 14 | - dependency-name: "org.jenkins-ci.plugins:plugin" 15 | - package-ecosystem: "github-actions" 16 | directory: "/" 17 | schedule: 18 | interval: "weekly" 19 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/ProjectMatrixAuthorizationStrategy/help_de.html: -------------------------------------------------------------------------------- 1 |
2 | Dieser Modus erweitert die "Matrix-basierte Sicherheit" um eine zusätzliche ACL-Rechtematrix, 3 | die für jedes Projekt individuell festgelegt werden kann (in der Konfigurationsmaske des jeweiligen Jobs). 4 | 5 |

6 | Dies erlaubt Ihnen eine Rechtevergabe wie z.B. "Joe darf auf Projekt A, B und C zugreifen - er 7 | soll aber Projekt D nicht sehen dürfen". Lesen Sie den Hilfetext bei "Matrix-basierte Sicherheit", 8 | um mehr über das Konzept der matrix-basierten Sicherheit im Allgemeinen zu erfahren. 9 | 10 |

11 | ACL-Rechte sind additiv. Dies bedeutet, dass die untenstehend erteilten Rechte für alle 12 | Projekte als erteilt gelten. 13 |

14 | -------------------------------------------------------------------------------- /src/main/resources/com/cloudbees/hudson/plugins/folder/properties/AuthorizationMatrixProperty/config.groovy: -------------------------------------------------------------------------------- 1 | package com.cloudbees.hudson.plugins.folder.properties.AuthorizationMatrixProperty 2 | 3 | import lib.FormTagLib 4 | import org.jenkinsci.plugins.matrixauth.inheritance.InheritanceStrategyDescriptor 5 | 6 | def f = namespace(FormTagLib) 7 | def st = namespace("jelly:stapler") 8 | 9 | f.optionalBlock(name: 'useProjectSecurity', checked: instance != null, title: _("Enable project-based security")) { 10 | f.nested { 11 | div { 12 | f.dropdownDescriptorSelector(title: _("Inheritance Strategy"), descriptors: InheritanceStrategyDescriptor.getApplicableDescriptors(my.class), field: 'inheritanceStrategy') 13 | st.include(class: "hudson.security.GlobalMatrixAuthorizationStrategy", page: "config") 14 | } 15 | } 16 | } -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceMigrationTest/jobs/folder/jobs/inheritNone/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | false 5 | 6 | 7 | true 8 | 9 | 10 | 11 | true 12 | false 13 | false 14 | false 15 | 16 | false 17 | 18 | 19 | 20 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceMigrationTest/jobs/job/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | false 5 | 6 | 7 | false 8 | hudson.model.Item.Read:bob 9 | hudson.model.Item.Configure:bob 10 | 11 | 12 | 13 | true 14 | false 15 | false 16 | false 17 | 18 | false 19 | 20 | 21 | 22 | -------------------------------------------------------------------------------- /src/test/resources/hudson/security/ProjectMatrixAuthorizationStrategyTest/JENKINS-58703.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | unused 4 | false 5 | 6 | 7 | 8 | hudson.model.Item.Read:authenticated 9 | 10 | 11 | 12 | true 13 | false 14 | false 15 | false 16 | 17 | false 18 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help.html: -------------------------------------------------------------------------------- 1 |
2 | In this scheme, you can configure who can do what by using a big table. 3 | 4 |

5 | Each column represents a permission. Hover the mouse over the permission names to get 6 | more information about what they represent. 7 | 8 |

9 | Each row represents a user or a group (often called 'role', depending on the security realm.) 10 | This includes a special user 'anonymous', which represents unauthenticated users, as well 11 | as 'authenticated', which represents all authenticated users (IOW, everyone except anonymous users.) 12 | Use the text box below the table to add new users/groups/roles to the table, and click the 13 | [x] icon to remove it from the table. 14 | 15 |

16 | Permissions are additive. That is, if an user X is in group A, B, and C, then 17 | the permissions that this user actually has are the union of all permissions given to 18 | X, A, B, C, and anonymous. 19 |

20 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config.groovy: -------------------------------------------------------------------------------- 1 | package hudson.security.AuthorizationMatrixProperty 2 | 3 | import hudson.model.Item 4 | import lib.FormTagLib 5 | import org.jenkinsci.plugins.matrixauth.inheritance.InheritanceStrategyDescriptor 6 | 7 | def f = namespace(FormTagLib) 8 | def st = namespace("jelly:stapler") 9 | 10 | f.optionalBlock(name: 'useProjectSecurity', checked: instance != null, title: _("Enable project-based security")) { 11 | f.nested { 12 | div { 13 | // It is unclear whether we can expect every Item to be an AbstractItem. While I've been unsuccessful finding one in a quick search, better be safe here and just offer fewer options if necessary. 14 | f.dropdownDescriptorSelector(title: _("Inheritance Strategy"), descriptors: InheritanceStrategyDescriptor.getApplicableDescriptors(my?.class?: Item.class), field: 'inheritanceStrategy') 15 | st.include(class: "hudson.security.GlobalMatrixAuthorizationStrategy", page: "config") 16 | } 17 | } 18 | } -------------------------------------------------------------------------------- /LICENSE.md: -------------------------------------------------------------------------------- 1 | The MIT License 2 | 3 | Copyright 2004-2025 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: 6 | 7 | The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. 8 | 9 | THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 10 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help_ru.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | В этом режиме вы можете явно указать допустимые операции, используя матрицу привилегий. 4 | 5 |

6 | Каждая колонка представляет собой привилегию. Наведите курсор мыши на имя привелегии 7 | для получения большей информации о её предназначении. 8 | 9 |

10 | Каждая строка представляет собой пользователя или группу (обычно называемая "ролью", в 11 | зависимости от используемого модуля безопасности). Список включает также специального 12 | пользователя Аноним, который представляет собой неаутентифицированного пользователя. 13 | Чтобы добавить нового пользователя/группу/роль в таблицу, используйте поле ввода под таблицей. 14 | Чтобы удалить пользователя/группу/роль нажмите кнопку [x] в правой колонке. 15 | 16 |

17 | Привилегии аддитивны, то есть если пользователь X состоит в группах A, B и C, тогда 18 | реальные привилегии пользователя - объединение всех привилегий данных конкретно пользователю, 19 | группам A, B и C и анонимному пользователю. 20 |

-------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/jobs/F/jobs/fs/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | false 5 | 6 | 7 | 8 | hudson.model.Item.Build:authenticated 9 | hudson.model.Item.Cancel:authenticated 10 | hudson.model.Item.Configure:authenticated 11 | 12 | 13 | 14 | true 15 | false 16 | false 17 | false 18 | 19 | false 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/jobs/F/jobs/fs/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | false 5 | 6 | 7 | 8 | hudson.model.Item.Build:authenticated 9 | hudson.model.Item.Cancel:authenticated 10 | hudson.model.Item.Configure:authenticated 11 | 12 | 13 | 14 | true 15 | false 16 | false 17 | false 18 | 19 | false 20 | 21 | 22 | 23 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help_de.html: -------------------------------------------------------------------------------- 1 |
2 | In dieser Tabelle können Sie angeben, wer zu welchen Aktionen berechtigt ist. 3 |

4 | Jede Spalte entspricht einer Berechtigung. Fahren Sie mit der Maus über die 5 | Namen der Berechtigungen, um mehr Informationen darüber zu erhalten, was sie 6 | bedeuten. 7 |

8 | Jede Zeile entspricht einem Benutzer oder einer Benutzergruppe (je nach 9 | Benutzerverzeichnis oft auch als "Rolle" bezeichnet). Die Zeilen beinhalten 10 | auch die besonderen Benutzer 'anonymous' bzw. 'authenticated', welche 11 | nichtangemeldete bzw. angemeldete Benutzer repräsentieren, 12 | 13 | Verwenden Sie das untenstehende Textfeld, um neue Benutzer/Gruppen/Rollen zur Tabelle 14 | hinzuzufügen und klicken Sie auf das [x]-Symbol, um sie wieder von der 15 | Tabelle zu entfernen. 16 |

17 | Berechtigungen sind additiv. Dies bedeutet, dass ein Benutzer X, der Mitglied 18 | in den Gruppen A, B und C ist, die Vereinigungsmenge aller Berechtigungen 19 | besitzt, die X, A, B, C und dem Benutzer 'anonymous' erteilt wurden. 20 |

-------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help_pt_BR.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Neste esquema, você pode configurar quem pode fazer o quê usando uma grande tabela. 4 | 5 |

6 | Cada coluna representa uma permissão. Passe o mouse sobre os nomes das permissões para 7 | obter mais informação sobre o que elas representam. 8 | 9 |

10 | Cada linha representa um usuário ou grupo (frequentemente chamado de 'papel', 11 | dependendo do domínio de segurança.) 12 | Isto inclui um usuário especial chamado 'anonymous', que representa os usuários não autenticados. 13 | Use a caixa de texto abaixo da tabela para adicionar novos usuários/grupos/papéis na tabela, e clique 14 | no ícone [x] para remover da tabela. 15 | 16 |

17 | Permissões são cumulativas. Ou seja, se um usuário X está nos grupos A, B, e C, então 18 | as permissões que este usuário na verdade tem é a únião de todas as permissões dadas para 19 | X, A, B, C, e anônimos. 20 |

21 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config.properties: -------------------------------------------------------------------------------- 1 | selectall=Grant all permissions to {0} 2 | unselectall=Remove all permissions from {0} 3 | remove=Remove entries for {0} 4 | migrate_user=Migrate ambiguous permissions assignment to user {0} 5 | migrate_group=Migrate ambiguous permissions assignment to group {0} 6 | tooltip_enabled={0}/{1} for {2} {3} 7 | tooltip_disabled={0}/{1} for {2} {3} is granted through another permission 8 | 9 | groupPrompt=Group name: 10 | groupError=An entry for this group already exists 11 | 12 | userPrompt=User ID: 13 | userError=An entry for this user already exists 14 | 15 | ambiguous=This table contains rows with ambiguous entries. This means that they apply both to users with the specified ID, and groups with the specified name. \ 16 | If the current security realm does not distinguish between user IDs and group names unambiguously, and if users can either choose their own user ID or create new groups, this configuration may allow them to obtain greater permissions. \ 17 | It is recommended that all ambiguous entries are replaced with ones that are either explicitly a user or group. 18 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help_tr.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Bu şemada, tabloyu kullanarak kimin ne yapabileceğini belirleyebilirsiniz. 4 | 5 |

6 | Her kolon bir yetkiyi temsil eder. Mouse ile yetki isimlerinin üzerine 7 | gelerek, daha fazla bilgi alabilirsiniz. 8 | 9 |

10 | Her satır bir kullanıcı veya grubu temsil eder (Güvenlik alanına bağlı olarak, "rol" olarak da 11 | adlandırılabilir). Bu satırların içerisinde yetkisiz kullanıcıları temsilen bilinmeyen (anonymous) 12 | kullanıcı da yer almaktadır. Aşağıdaki metin kutusunu kullanarak, tabloya kullanıcı/grup/rol ekleyebilir, 13 | [x] ikonuna tıklayarak bunları silebilirsiniz. 14 | 15 |

16 | Yetkilendirme, kullanıcı ve ait olduğu grupların yetkilerinin birleşim kümesi ile hesaplanır. 17 | Yani X kullanıcısı, A, B ve C gruplarına dahilse, yetkileri X, A, B, C ve bilinmeyen kullanıcıya 18 | verilen yetkilerinin birleşim kümesidir. 19 |

-------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/help_fr.html: -------------------------------------------------------------------------------- 1 |
2 | 3 | Cette option vous permet de configurer qui fait quoi dans un grand tableau. 4 | 5 |

6 | Chaque colonne représente une autorisation. Faites glisser la souris au 7 | dessus du nom d'une autorisation pour obtenir plus d'information sur 8 | ce qu'elle représente. 9 | 10 |

11 | Chaque ligne représente un utilisateur ou un groupe (souvent appelé 12 | 'rôle', selon les royaumes -realms- de sécurité). 13 | On y trouve un utilisateur spécial 'anonymous' qui représente 14 | les utilisateurs non authentifiés, ainsi qu'un utilisateur 'authenticated', 15 | qui représente les utilisateurs authentifiés (c-à-d, tout le monde, à 16 | l'exception des utilisateurs anonymes). 17 | Utilisez le texte sous la table pour ajouter des nouveaux 18 | utilisateurs/groupes/rôles à la table et cliquez sur l'icône 19 | [x] pour les supprimer. 20 | 21 |

22 | Les autorisations s'ajoutent les unes aux autres. En clair, si un 23 | utilisateur X est présent dans les groupes A, B et C, alors les 24 | autorisations associées à cet utilisateur sont l'union de toutes les 25 | autorisations accordées à X, A, B, C et anonymous. 26 |

-------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_tr.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=Matris-temelli G\u00fcvenlik 24 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_nl.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=Matrix-gebaseerde beveiliging 24 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/nodes/a1/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | a1 4 | 5 | /tmp/a1 6 | 1 7 | NORMAL 8 | 9 | 10 | 11 | false 12 | remoting 13 | false 14 | 15 | true 16 | 17 | 18 | 19 | 20 | 21 | hudson.model.Computer.Build:anonymous 22 | hudson.model.Computer.Configure:authenticated 23 | hudson.model.Computer.Connect:authenticated 24 | hudson.model.Computer.Disconnect:authenticated 25 | 26 | 27 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_nb_NO.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Anonymous=Anonym 24 | User/group=Bruker/gruppe 25 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_pt_BR.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=Seguran\u00e7a baseada em matriz 24 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/nodes/a1/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | a1 4 | 5 | /tmp/a1 6 | 1 7 | NORMAL 8 | 9 | 10 | 11 | false 12 | remoting 13 | false 14 | 15 | true 16 | 17 | 18 | 19 | 20 | 21 | hudson.model.Computer.Build:anonymous 22 | hudson.model.Computer.Configure:authenticated 23 | hudson.model.Computer.Connect:authenticated 24 | hudson.model.Computer.Disconnect:authenticated 25 | 26 | 27 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_es.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Enable\ project-based\ security=Habilitar seguridad en el projecto 24 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_fi.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Remove\ user/group=Poista k\u00E4ytt\u00E4j\u00E4/ryhm\u00E4 24 | -------------------------------------------------------------------------------- /src/test/java/hudson/security/Security410Test.java: -------------------------------------------------------------------------------- 1 | package hudson.security; 2 | 3 | import static org.junit.jupiter.api.Assertions.assertFalse; 4 | 5 | import hudson.PluginManager; 6 | import jenkins.model.Jenkins; 7 | import org.junit.jupiter.api.BeforeEach; 8 | import org.junit.jupiter.api.Test; 9 | import org.jvnet.hudson.test.Issue; 10 | import org.jvnet.hudson.test.JenkinsRule; 11 | import org.jvnet.hudson.test.junit.jupiter.WithJenkins; 12 | 13 | @WithJenkins 14 | class Security410Test { 15 | 16 | private JenkinsRule j; 17 | 18 | @BeforeEach 19 | void setUp(JenkinsRule rule) { 20 | j = rule; 21 | } 22 | 23 | @Issue("SECURITY-410") 24 | @Test 25 | @SuppressWarnings("deprecation") 26 | void dangerousPermissions1() { 27 | ProjectMatrixAuthorizationStrategy as = new ProjectMatrixAuthorizationStrategy(); 28 | assertFalse(((GlobalMatrixAuthorizationStrategy.DescriptorImpl) as.getDescriptor()) 29 | .showPermission(Jenkins.RUN_SCRIPTS)); 30 | assertFalse(((GlobalMatrixAuthorizationStrategy.DescriptorImpl) as.getDescriptor()) 31 | .showPermission(PluginManager.CONFIGURE_UPDATECENTER)); 32 | assertFalse(((GlobalMatrixAuthorizationStrategy.DescriptorImpl) as.getDescriptor()) 33 | .showPermission(PluginManager.UPLOAD_PLUGINS)); 34 | } 35 | } 36 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_tr.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Oguz Dag 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | User/group=Kullan\u0131c\u0131/grup 24 | Anonymous=Bilinmeyen 25 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_es.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | User/group=Usuario/Grupo 24 | Remove\ user/group=Borrar usuario/grupo 25 | Toggle\ all=Cambiar todo 26 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_da.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc. Kohsuke Kawaguchi. Knud Poulsen. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Enable\ project-based\ security=Sl\u00e5 projektbaseret adgangskontrol til 24 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_zh_TW.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2013, Chunghwa Telecom Co., Ltd., Pei-Tang Huang 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Enable\ project-based\ security=\u555f\u7528\u5c08\u6848\u578b\u5b89\u5168\u6027\u8a2d\u5b9a 24 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceStrategy/config.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 | 28 | 29 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/ExportTest/exportTestLegacy/nodes/agent1/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | agent1 4 | 1 5 | NORMAL 6 | 7 | 8 | 9 | false 10 | remoting 11 | false 12 | 13 | 14 | 15 | 16 | 17 | 18 | hudson.model.Computer.Build:anonymous 19 | hudson.model.Computer.Build:authenticated 20 | hudson.model.Computer.Configure:authenticated 21 | hudson.model.Computer.Connect:authenticated 22 | hudson.model.Computer.Delete:authenticated 23 | hudson.model.Computer.Disconnect:authenticated 24 | 25 | 26 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceMigrationTest/users/bob/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | Bob 4 | 5 | 6 | {AQAAABAAAAAwjQ/AtGDcImIkLDhq69pgnztzZq5jDwcRsZjwRnH+M/GunPrOxaLbCjBU1Xn1fRq1FHbmZXZV6klo0181L8HnSg==} 7 | 8 | 9 | 10 | 11 | 12 | all 13 | false 14 | false 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | true 24 | 25 | 26 | #jbcrypt:$2a$10$Q/.u9U7mphJ4q6Mfifa.Oufm6w4iUCs5TRHVLY/1m..kAqw0qGn.O 27 | 28 | 29 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceMigrationTest/users/admin/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | admin 4 | 5 | 6 | {AQAAABAAAAAwGlr2GmbKMnWJDyTmXdB/J1yPDUj/A8tAFk8Sl7g7ZZIdEzMcatUYTgFQx2DqaKpGkQEV3V9vvLcGRIFkKLcbHg==} 7 | 8 | 9 | 10 | 11 | 12 | all 13 | false 14 | false 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | true 24 | 25 | 26 | #jbcrypt:$2a$10$8ikKOpe48MnWcKt4nIct6eY.DKVQhRqrlYx.fa.Mt7Ya1X9tFxMtS 27 | 28 | 29 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceMigrationTest/users/alice/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | Alice 4 | 5 | 6 | {AQAAABAAAAAw++0Gifydu+kMl6DwWZxMyXeka/KVmOYbv6ljP7ljepmP4r7Q2oa04Z5Wp7WaOTEKxPfEgg2/v3ALLHn6J9SDKw==} 7 | 8 | 9 | 10 | 11 | 12 | all 13 | false 14 | false 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | true 24 | 25 | 26 | #jbcrypt:$2a$10$gcruH6YoDS/Sr0Yd9uSDdeqqZ9GidPEBPCKdzWCpDsdrNbQJwTAwC 27 | 28 | 29 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_tr.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Oguz Dag 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Enable\ project-based\ security=Proje tabanl\u0131 g\u00fcvenlik ayarlar\u0131n\u0131 devreye al 24 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_da.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc. Kohsuke Kawaguchi. Knud Poulsen. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Anonymous=Anonym 24 | Remove\ user/group=Fjern user/gruppe 25 | User/group=Bruger/gruppe 26 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_pt_BR.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Reginaldo L. Russinholi, Cleiber Silva 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | User/group=Usu\u00E1rios/Grupo 24 | Anonymous=An\u00f4nimo 25 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_da.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | ProjectMatrixAuthorizationStrategy.DisplayName=Projektbaseret matriceauthentificering 24 | GlobalMatrixAuthorizationStrategy.DisplayName=Matricebaseret sikkerhed 25 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_nl.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, id:sorokh 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Remove\ user/group=Verwijder gebruiker/groep 24 | User/group=Gebruiker/groep 25 | Anonymous=Anoniem 26 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_de.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=Matrix-basierte Sicherheit 24 | ProjectMatrixAuthorizationStrategy.DisplayName=Projektbasierte Matrix-Zugriffssteuerung 25 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_pt_BR.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Reginaldo L. Russinholi, Cleiber Silva 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Enable\ project-based\ security=Habilitar seguran\u00e7a baseada em projeto 24 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_es.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=Configuraci\u00f3n de seguridad 24 | ProjectMatrixAuthorizationStrategy.DisplayName=Estrategia de seguridad para el proyecto 25 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_zh_CN.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=\u5b89\u5168\u77e9\u9635 24 | ProjectMatrixAuthorizationStrategy.DisplayName=\u9879\u76ee\u77e9\u9635\u6388\u6743\u7b56\u7565 25 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/ExportTest/exportTest/nodes/agent1/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | agent1 4 | 1 5 | NORMAL 6 | 7 | 8 | 9 | false 10 | remoting 11 | false 12 | 13 | 14 | 15 | 16 | 17 | 18 | USER:hudson.model.Computer.Build:anonymous 19 | GROUP:hudson.model.Computer.Build:authenticated 20 | GROUP:hudson.model.Computer.Configure:authenticated 21 | GROUP:hudson.model.Computer.Connect:authenticated 22 | GROUP:hudson.model.Computer.Delete:authenticated 23 | GROUP:hudson.model.Computer.Disconnect:authenticated 24 | 25 | 26 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_sv_SE.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Anonymous=Anonym 24 | Remove\ user/group=Ta bort anv\u00E4ndare/grupp 25 | Toggle\ all=V\u00E4xla alla 26 | User/group=Anv\u00E4ndare/grupp 27 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_fr.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Eric Lefevre-Ardant 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Remove\ user/group=Supprimer utilisateur/groupe 24 | User/group=Utilisateur/groupe 25 | Anonymous=Anonyme 26 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_zh_TW.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=\u77e9\u9663\u578b\u5b89\u5168\u6027 24 | ProjectMatrixAuthorizationStrategy.DisplayName=\u5c08\u6848\u578b\u77e9\u9663\u6388\u6b0a\u7b56\u7565 25 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritGlobalStrategy/config.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 | ${%blurb(rootURL)} 28 | 29 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritParentStrategy/config.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 | ${%blurb(rootURL)} 28 | 29 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/inheritance/NonInheritingStrategy/config.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 | ${%blurb(rootURL)} 28 | 29 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/AuthorizationMatrixProperty/config_ja.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi, Seiji Sogabe 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Enable\ project-based\ security=\u6A29\u9650\u8A2D\u5B9A(\u30D7\u30ED\u30B8\u30A7\u30AF\u30C8\u5358\u4F4D)\u306E\u6709\u52B9\u5316 24 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_ru.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=\u041c\u0430\u0442\u0440\u0438\u0447\u043d\u043e\u0435 \u0440\u0430\u0441\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432 24 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_de.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Simon Wiest 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Remove\ user/group=Nutzer/Gruppe entfernen 24 | Toggle\ all=Alles ausw\u00E4hlen 25 | User/group=Benutzer/Gruppe 26 | Anonymous=Anonym 27 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_zh_CN.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2010, Sun Microsystems, Inc. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Remove\ user/group=\u79FB\u9664\u7528\u6237/\u7EC4 24 | Toggle\ all=\u5C55\u5F00\u5168\u90E8 25 | User/group=\u7528\u6237/\u7ec4 26 | Anonymous=\u533f\u540d\u7528\u6237 27 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_fr.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=S\u00e9curit\u00e9 bas\u00e9e sur une matrice 24 | ProjectMatrixAuthorizationStrategy.DisplayName=Strat\u00e9gie d''autorisation matricielle bas\u00e9e sur les projets 25 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages_ja.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=\u884c\u5217\u306b\u3088\u308b\u6a29\u9650\u8a2d\u5b9a 24 | ProjectMatrixAuthorizationStrategy.DisplayName=\u884c\u5217\u306b\u3088\u308b\u6a29\u9650\u8a2d\u5b9a(\u30d7\u30ed\u30b8\u30a7\u30af\u30c8\u5358\u4f4d) 25 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/AmbiguityMonitor/GlobalConfigurationContributor/entries.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 |
  • 28 | 29 | ${%Configure Global Security} 30 | 31 |
    • 32 |     33 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_zh_TW.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2013, Sun Microsystems, Inc., Chunghwa Telecom Co., Ltd., 4 | # and Pei-Tang Huang 5 | # 6 | # Permission is hereby granted, free of charge, to any person obtaining a copy 7 | # of this software and associated documentation files (the "Software"), to deal 8 | # in the Software without restriction, including without limitation the rights 9 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | # copies of the Software, and to permit persons to whom the Software is 11 | # furnished to do so, subject to the following conditions: 12 | # 13 | # The above copyright notice and this permission notice shall be included in 14 | # all copies or substantial portions of the Software. 15 | # 16 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | # THE SOFTWARE. 23 | 24 | Toggle\ all=\u53cd\u5411\u9078\u53d6 25 | Remove\ user/group=\u79fb\u9664\u4f7f\u7528\u8005\u6216\u7fa4\u7d44 26 | 27 | User/group=\u4f7f\u7528\u8005\u6216\u7fa4\u7d44 28 | Anonymous=\u533f\u540d\u4f7f\u7528\u8005 29 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/AmbiguityMonitor/message.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2021 CloudBees, Inc. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | blurb = Some permission assignments are ambiguous. It is recommended to update affected configurations to be unambiguous. \ 24 | See this overview page for a list of affected configurations. 25 | 26 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/jobs/F/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | hudson.model.View.Configure:authenticated 8 | hudson.model.View.Create:authenticated 9 | hudson.model.View.Delete:authenticated 10 | hudson.model.View.Read:authenticated 11 | 12 | 13 | 14 | 15 | 16 | 17 | All 18 | false 19 | false 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_ja.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2012, Sun Microsystems, Inc., Kohsuke Kawaguchi, Seiji Sogabe 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Anonymous=\u533f\u540d\u30e6\u30fc\u30b6\u30fc 24 | User/group=\u30e6\u30fc\u30b6\u30fc/\u30b0\u30eb\u30fc\u30d7 25 | 26 | Toggle\ all=\u3059\u3079\u3066\u53cd\u8ee2 27 | Remove\ user/group=\u30e6\u30fc\u30b6/\u30b0\u30eb\u30fc\u30d7\u3092\u524a\u9664 28 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/jobs/F/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | hudson.model.View.Configure:authenticated 8 | hudson.model.View.Create:authenticated 9 | hudson.model.View.Delete:authenticated 10 | hudson.model.View.Read:authenticated 11 | 12 | 13 | 14 | 15 | 16 | 17 | All 18 | false 19 | false 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/configuration-as-code-v1.yml: -------------------------------------------------------------------------------- 1 | jenkins: 2 | authorizationStrategy: 3 | projectMatrix: 4 | grantedPermissions: 5 | - "Agent/Build:authenticated" 6 | - "Agent/Configure:authenticated" 7 | - "Agent/Connect:authenticated" 8 | - "Agent/Create:authenticated" 9 | - "Agent/Delete:authenticated" 10 | - "Agent/Disconnect:authenticated" 11 | - "Credentials/Create:authenticated" 12 | - "Credentials/Delete:authenticated" 13 | - "Credentials/ManageDomains:authenticated" 14 | - "Credentials/Update:authenticated" 15 | - "Credentials/View:authenticated" 16 | - "Job/Build:authenticated" 17 | - "Job/Cancel:authenticated" 18 | - "Job/Configure:authenticated" 19 | - "Job/Create:authenticated" 20 | - "Job/Delete:authenticated" 21 | - "Job/Discover:authenticated" 22 | - "Job/Move:authenticated" 23 | - "Job/Read:authenticated" 24 | - "Job/Workspace:authenticated" 25 | - "Overall/Read:anonymous" 26 | - "Overall/Administer:authenticated" 27 | - "Overall/Read:authenticated" 28 | - "Run/Delete:authenticated" 29 | - "Run/Replay:authenticated" 30 | - "Run/Update:authenticated" 31 | - "View/Configure:authenticated" 32 | - "View/Create:authenticated" 33 | - "View/Delete:authenticated" 34 | - "View/Read:authenticated" 35 | securityRealm: 36 | local: 37 | allowsSignup: true 38 | enableCaptcha: false 39 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/users/user_5543844453642095256/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 10 4 | user 5 | user 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | all 17 | false 18 | false 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | fada94384ea465e4 28 | 29 | 30 | true 31 | 32 | 33 | 34 | #jbcrypt:$2a$10$pWGP08hcS.cSnk1cUNvIF.92wo0jM3qmccDGXWz..Bd1Lth8lrlvq 35 | 36 | 37 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/users/admin_7258660542409517449/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 10 4 | admin 5 | admin 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | all 17 | false 18 | false 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 6c0c4a93275a666c 28 | 29 | 30 | true 31 | 32 | 33 | 34 | #jbcrypt:$2a$10$eERHsRE.4OYQ3Mv4fsU6berDmtoQ3BFSRuBwmqbEyUvt.Uo/3ERyS 35 | 36 | 37 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/AmbiguityMonitor/message.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 |
    28 |
    29 | 30 | 31 | ${%blurb(rootURL)} 32 |
    33 |     34 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/users/admin_7258660542409517449/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 10 4 | admin 5 | admin 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | all 17 | false 18 | false 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | 6c0c4a93275a666c 28 | 29 | 30 | true 31 | 32 | 33 | 34 | #jbcrypt:$2a$10$eERHsRE.4OYQ3Mv4fsU6berDmtoQ3BFSRuBwmqbEyUvt.Uo/3ERyS 35 | 36 | 37 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/users/user_5543844453642095256/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 10 4 | user 5 | user 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | all 17 | false 18 | false 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | fada94384ea465e4 28 | 29 | 30 | true 31 | 32 | 33 | 34 | #jbcrypt:$2a$10$pWGP08hcS.cSnk1cUNvIF.92wo0jM3qmccDGXWz..Bd1Lth8lrlvq 35 | 36 | 37 | -------------------------------------------------------------------------------- /src/test/resources/hudson/security/ProjectMatrixAuthorizationStrategyTest/loadEmptyAuthorizationStrategy/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 1.0 5 | 2 6 | NORMAL 7 | true 8 | 9 | 10 | false 11 | 12 | ${JENKINS_HOME}/workspace/${ITEM_FULLNAME} 13 | ${ITEM_ROOTDIR}/builds 14 | 15 | 16 | 17 | 18 | 19 | 0 20 | 21 | 22 | 23 | all 24 | false 25 | false 26 | 27 | 28 | 29 | all 30 | 0 31 | 32 | 33 | 34 | -------------------------------------------------------------------------------- /src/test/java/org/jenkinsci/plugins/matrixauth/Jenkins57313Test.java: -------------------------------------------------------------------------------- 1 | package org.jenkinsci.plugins.matrixauth; 2 | 3 | import static org.junit.jupiter.api.Assertions.assertEquals; 4 | import static org.junit.jupiter.api.Assertions.assertTrue; 5 | 6 | import hudson.security.GlobalMatrixAuthorizationStrategy; 7 | import jenkins.model.Jenkins; 8 | import org.htmlunit.html.HtmlPage; 9 | import org.junit.jupiter.api.BeforeEach; 10 | import org.junit.jupiter.api.Test; 11 | import org.jvnet.hudson.test.Issue; 12 | import org.jvnet.hudson.test.JenkinsRule; 13 | import org.jvnet.hudson.test.junit.jupiter.WithJenkins; 14 | 15 | @WithJenkins 16 | class Jenkins57313Test { 17 | 18 | private JenkinsRule j; 19 | 20 | @BeforeEach 21 | void setUp(JenkinsRule rule) { 22 | j = rule; 23 | } 24 | 25 | @Test 26 | @Issue("JENKINS-57313") 27 | void testFormValidation() throws Exception { 28 | j.jenkins.setSecurityRealm(j.createDummySecurityRealm()); 29 | GlobalMatrixAuthorizationStrategy authorizationStrategy = new GlobalMatrixAuthorizationStrategy(); 30 | authorizationStrategy.add(Jenkins.ADMINISTER, "anonymous"); 31 | j.jenkins.setAuthorizationStrategy(authorizationStrategy); 32 | HtmlPage page = j.createWebClient() 33 | .goTo(authorizationStrategy.getDescriptor().getDescriptorUrl() + "/checkName?value=[USER:alice]"); 34 | assertEquals(200, page.getWebResponse().getStatusCode()); 35 | String responseText = page.getWebResponse().getContentAsString(); 36 | assertTrue(responseText.contains("alice")); 37 | assertTrue(responseText.contains("User")); 38 | } 39 | } 40 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceMigrationTest/jobs/folder/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | true 8 | hudson.model.Item.Read:admin 9 | hudson.model.Item.Create:admin 10 | hudson.model.Item.Configure:admin 11 | 12 | 13 | 14 | 15 | 16 | 17 | All 18 | false 19 | false 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | false 28 | 29 | 30 | 31 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceMigrationTest/jobs/folder1/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | true 8 | hudson.model.Item.Configure:alice 9 | hudson.model.Item.Configure:admin 10 | hudson.model.Item.Read:alice 11 | 12 | 13 | 14 | 15 | 16 | 17 | All 18 | false 19 | false 20 | 21 | 22 | 23 | 24 | 25 | 26 | 27 | false 28 | 29 | 30 | 31 | -------------------------------------------------------------------------------- /src/main/java/com/cloudbees/hudson/plugins/folder/properties/OptionalMarker.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2021, CloudBees, Inc. 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package com.cloudbees.hudson.plugins.folder.properties; 25 | 26 | import org.kohsuke.accmod.Restricted; 27 | import org.kohsuke.accmod.restrictions.NoExternalUse; 28 | 29 | /** 30 | * Just to enforce the optional extension to fail loading when the desired class is not available. 31 | * @param The class coming from the optional plugin 32 | */ 33 | @Restricted(NoExternalUse.class) 34 | public interface OptionalMarker {} 35 | -------------------------------------------------------------------------------- /src/test/resources/hudson/security/ProjectMatrixAuthorizationStrategyTest/loadFilledAuthorizationStrategy/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 1.0 5 | 2 6 | NORMAL 7 | true 8 | 9 | hudson.model.Hudson.Administer:alice 10 | 11 | 12 | false 13 | 14 | ${JENKINS_HOME}/workspace/${ITEM_FULLNAME} 15 | ${ITEM_ROOTDIR}/builds 16 | 17 | 18 | 19 | 20 | 21 | 0 22 | 23 | 24 | 25 | all 26 | false 27 | false 28 | 29 | 30 | 31 | all 32 | 0 33 | 34 | 35 | 36 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config_ru.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Mike Salnikov 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | Remove\ user/group=\u0423\u0434\u0430\u043B\u0438\u0442\u044C \u043F\u043E\u043B\u044C\u0437\u043E\u0432\u0430\u0442\u0435\u043B\u044F/\u0433\u0440\u0443\u043F\u043F\u0443 24 | Toggle\ all=\u041F\u0435\u0440\u0435\u043A\u043B\u044E\u0447\u0438\u0442\u044C \u0432\u0441\u0451 25 | User/group=\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c/\u0433\u0440\u0443\u043f\u043f\u0430 26 | Anonymous=\u0410\u043d\u043e\u043d\u0438\u043c 27 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/AuthorizationType.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2021 CloudBees, Inc. 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth; 25 | 26 | /** 27 | * The type of object being granted authorization. 28 | * 29 | * @since 3.0 30 | */ 31 | public enum AuthorizationType { 32 | /** 33 | * Either type is being granted permissions. 34 | * This is the legacy default. 35 | */ 36 | EITHER, 37 | GROUP, 38 | USER; 39 | 40 | public String toPrefix() { 41 | if (this == AuthorizationType.EITHER) { 42 | return ""; // Same as legacy format 43 | } 44 | return this + ":"; 45 | } 46 | } 47 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/AmbiguityMonitor/JobContributor/entries.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 | 28 |
  • 29 | ${%Jobs} 30 | 39 |
    • 40 |     41 |     42 | -------------------------------------------------------------------------------- /src/main/resources/com/cloudbees/hudson/plugins/folder/properties/FolderContributor/entries.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 | 28 |
  • 29 | ${%Folders} 30 | 39 |
    • 40 |     41 |     42 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/Messages.properties: -------------------------------------------------------------------------------- 1 | # The MIT License 2 | # 3 | # Copyright 2013 Jesse Glick. 4 | # 5 | # Permission is hereby granted, free of charge, to any person obtaining a copy 6 | # of this software and associated documentation files (the "Software"), to deal 7 | # in the Software without restriction, including without limitation the rights 8 | # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | # copies of the Software, and to permit persons to whom the Software is 10 | # furnished to do so, subject to the following conditions: 11 | # 12 | # The above copyright notice and this permission notice shall be included in 13 | # all copies or substantial portions of the Software. 14 | # 15 | # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 21 | # THE SOFTWARE. 22 | 23 | GlobalMatrixAuthorizationStrategy.DisplayName=Matrix-based security 24 | ProjectMatrixAuthorizationStrategy.DisplayName=Project-based Matrix Authorization Strategy 25 | AuthorizationMatrixNodeProperty.DisplayName=Enable node-based security 26 | GlobalMatrixAuthorizationStrategy.PermissionImpliedBy=This permission is implied by {0}/{1}. 27 | GlobalMatrixAuthorizationStrategy.PermissionNotImpliedBy=This permission is not implied by Overall/Administer. It needs to be explicitly granted even to administrators. 28 | 29 | TypeLabel_user = user 30 | TypeLabel_group = group 31 | TypeLabel_either = user or group 32 | 33 | AmbiguityMonitor.DisplayName = Ambiguous Permission Assignments 34 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xDeletion/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 2.222.1 5 | RUNNING 6 | 2 7 | NORMAL 8 | true 9 | 10 | USER:hudson.model.Hudson.Administer:admin 11 | 12 | 13 | true 14 | false 15 | 16 | false 17 | 18 | ${JENKINS_HOME}/workspace/${ITEM_FULL_NAME} 19 | ${ITEM_ROOTDIR}/builds 20 | 21 | 22 | 23 | 24 | 25 | 0 26 | 27 | 28 | 29 | all 30 | false 31 | false 32 | 33 | 34 | 35 | all 36 | -1 37 | 38 | 39 | false 40 | 41 | 42 | 43 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceMigrationTest/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 2.0 5 | 2 6 | NORMAL 7 | true 8 | 9 | hudson.model.Hudson.Administer:admin 10 | hudson.model.Hudson.Read:alice 11 | hudson.model.Hudson.Read:bob 12 | hudson.model.Item.Read:alice 13 | 14 | 15 | true 16 | false 17 | 18 | false 19 | 20 | ${JENKINS_HOME}/workspace/${ITEM_FULLNAME} 21 | ${ITEM_ROOTDIR}/builds 22 | 23 | 24 | 25 | 26 | 27 | 0 28 | 29 | 30 | 31 | all 32 | false 33 | false 34 | 35 | 36 | 37 | all 38 | -1 39 | 40 | 41 | false 42 | 43 | 44 | 45 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/AmbiguityMonitor/NodeContributor/entries.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 | 28 |
  • 29 | ${%Agents} 30 | 44 |
    • 45 |     46 |     47 | -------------------------------------------------------------------------------- /src/main/resources/org/jenkinsci/plugins/matrixauth/AmbiguityMonitor/index.jelly: -------------------------------------------------------------------------------- 1 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 |

    ${it.displayName}

    36 |

    ${%blurb}

    37 |

    38 | ${%title} 39 |

    40 |
      41 | 42 | 43 | 44 |
    45 |     46 |     47 |     48 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/AmbiguityTest/testDataFrom2xReconfiguration/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 2.222.1 5 | RUNNING 6 | 2 7 | NORMAL 8 | true 9 | 10 | hudson.model.Hudson.Administer:admin 11 | hudson.model.Hudson.Read:anonymous 12 | hudson.model.Item.Discover:authenticated 13 | hudson.model.Item.Read:authenticated 14 | hudson.model.Item.Workspace:authenticated 15 | 16 | 17 | true 18 | false 19 | 20 | false 21 | 22 | ${JENKINS_HOME}/workspace/${ITEM_FULL_NAME} 23 | ${ITEM_ROOTDIR}/builds 24 | 25 | 26 | 27 | 28 | 29 | 0 30 | 31 | 32 | 33 | all 34 | false 35 | false 36 | 37 | 38 | 39 | all 40 | -1 41 | 42 | 43 | false 44 | 45 | 46 | 47 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceStrategyDescriptor.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2017 Daniel Beck 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.inheritance; 25 | 26 | import hudson.DescriptorExtensionList; 27 | import hudson.model.Descriptor; 28 | import java.util.ArrayList; 29 | import java.util.List; 30 | import jenkins.model.Jenkins; 31 | 32 | public abstract class InheritanceStrategyDescriptor extends Descriptor { 33 | 34 | public static DescriptorExtensionList all() { 35 | return Jenkins.get().getDescriptorList(InheritanceStrategy.class); 36 | } 37 | 38 | public static List getApplicableDescriptors(Class clazz) { 39 | List result = new ArrayList<>(); 40 | List list = all(); 41 | for (InheritanceStrategyDescriptor isd : list) { 42 | if (isd.isApplicable(clazz)) { 43 | result.add(isd); 44 | } 45 | } 46 | return result; 47 | } 48 | 49 | public abstract boolean isApplicable(Class clazz); 50 | } 51 | -------------------------------------------------------------------------------- /src/test/java/org/jenkinsci/plugins/matrixauth/PermissionAdderTest.java: -------------------------------------------------------------------------------- 1 | package org.jenkinsci.plugins.matrixauth; 2 | 3 | import static org.junit.jupiter.api.Assertions.assertNotNull; 4 | import static org.junit.jupiter.api.Assertions.assertTrue; 5 | 6 | import hudson.model.User; 7 | import hudson.security.GlobalMatrixAuthorizationStrategy; 8 | import hudson.security.HudsonPrivateSecurityRealm; 9 | import hudson.security.pages.SignupPage; 10 | import java.util.Collections; 11 | import java.util.Objects; 12 | import jenkins.model.Jenkins; 13 | import org.htmlunit.ElementNotFoundException; 14 | import org.junit.jupiter.api.Test; 15 | import org.junit.jupiter.api.extension.RegisterExtension; 16 | import org.jvnet.hudson.test.Issue; 17 | import org.jvnet.hudson.test.JenkinsRule; 18 | import org.jvnet.hudson.test.junit.jupiter.JenkinsSessionExtension; 19 | 20 | class PermissionAdderTest { 21 | 22 | @RegisterExtension 23 | private final JenkinsSessionExtension sessions = new JenkinsSessionExtension(); 24 | 25 | @Test 26 | @Issue("JENKINS-20520") 27 | void ensureSavingAfterInitialUser() throws Throwable { 28 | sessions.then(j -> { 29 | j.jenkins.setSecurityRealm(new HudsonPrivateSecurityRealm(true, false, null)); 30 | j.jenkins.setAuthorizationStrategy(new GlobalMatrixAuthorizationStrategy()); 31 | j.jenkins.save(); 32 | 33 | JenkinsRule.WebClient wc = j.createWebClient(); 34 | SignupPage signup = new SignupPage(wc.goTo("signup")); 35 | signup.enterUsername("alice"); 36 | signup.enterPassword("alice"); 37 | signup.enterFullName("Alice User"); 38 | try { 39 | signup.enterEmail("alice@nowhere.net"); 40 | } catch (ElementNotFoundException x) { 41 | // mailer plugin not installed, fine 42 | } 43 | signup.submit(j); 44 | User alice = User.get("alice", false, Collections.emptyMap()); 45 | assertNotNull(alice); 46 | assertTrue(j.jenkins.getACL().hasPermission2(alice.impersonate2(), Jenkins.ADMINISTER)); 47 | }); 48 | sessions.then(j -> assertTrue(j.jenkins 49 | .getACL() 50 | .hasPermission2( 51 | Objects.requireNonNull(User.get("alice", false, Collections.emptyMap())) 52 | .impersonate2(), 53 | Jenkins.ADMINISTER))); 54 | } 55 | } 56 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/DeprecationUtil.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2021 CloudBees, Inc. 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth; 25 | 26 | import java.util.logging.Level; 27 | import java.util.logging.Logger; 28 | import org.kohsuke.accmod.Restricted; 29 | import org.kohsuke.accmod.restrictions.NoExternalUse; 30 | 31 | /** 32 | * @since 3.0 33 | */ 34 | @Restricted(NoExternalUse.class) 35 | public final class DeprecationUtil { 36 | private DeprecationUtil() { 37 | // do not instantiate 38 | } 39 | /** 40 | * Logs a message using the caller's logger about the caller's caller. 41 | */ 42 | public static void logDeprecationMessage() { 43 | final StackTraceElement[] stackTrace = new Exception().getStackTrace(); 44 | 45 | if (stackTrace.length < 3) { 46 | return; 47 | } 48 | 49 | final StackTraceElement calledDeprecatedMethod = stackTrace[1]; 50 | final StackTraceElement caller = stackTrace[2]; 51 | 52 | Logger.getLogger(calledDeprecatedMethod.getClassName()) 53 | .log( 54 | Level.INFO, 55 | () -> "Deprecated method " + calledDeprecatedMethod.getClassName() + "#" 56 | + calledDeprecatedMethod.getMethodName() + " called by " + caller.getClassName()); 57 | } 58 | } 59 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/configuration-as-code-v2-ambiguous.yml: -------------------------------------------------------------------------------- 1 | jenkins: 2 | authorizationStrategy: 3 | projectMatrix: 4 | permissions: 5 | - "Agent/Build:authenticated" 6 | - "Agent/Configure:authenticated" 7 | - "Agent/Connect:authenticated" 8 | - "Agent/Create:authenticated" 9 | - "Agent/Delete:authenticated" 10 | - "Agent/Disconnect:authenticated" 11 | - "Credentials/Create:authenticated" 12 | - "Credentials/Delete:authenticated" 13 | - "Credentials/ManageDomains:authenticated" 14 | - "Credentials/Update:authenticated" 15 | - "Credentials/View:authenticated" 16 | - "Job/Build:authenticated" 17 | - "Job/Cancel:authenticated" 18 | - "Job/Configure:authenticated" 19 | - "Job/Create:authenticated" 20 | - "Job/Delete:authenticated" 21 | - "Job/Discover:authenticated" 22 | - "Job/Move:authenticated" 23 | - "Job/Read:authenticated" 24 | - "Job/Workspace:authenticated" 25 | - "Overall/Read:anonymous" 26 | - "Overall/Administer:authenticated" 27 | - "Overall/Read:authenticated" 28 | - "Run/Delete:authenticated" 29 | - "Run/Replay:authenticated" 30 | - "Run/Update:authenticated" 31 | - "View/Configure:authenticated" 32 | - "View/Create:authenticated" 33 | - "View/Delete:authenticated" 34 | - "View/Read:authenticated" 35 | nodes: 36 | - permanent: 37 | launcher: 38 | jnlp: 39 | workDirSettings: 40 | disabled: false 41 | failIfWorkDirIsMissing: false 42 | internalDir: "remoting" 43 | name: "agent1" 44 | nodeProperties: 45 | - authorizationMatrix: 46 | inheritanceStrategy: "inheritingGlobal" 47 | permissions: 48 | - "Agent/Disconnect:authenticated" 49 | - "Agent/Build:authenticated" 50 | - "Agent/Build:anonymous" 51 | numExecutors: 1 52 | retentionStrategy: "always" 53 | securityRealm: 54 | local: 55 | allowsSignup: true 56 | enableCaptcha: false 57 | jobs: 58 | - script: > 59 | folder('generated') { 60 | properties { 61 | authorizationMatrix { 62 | inheritanceStrategy { 63 | nonInheriting() 64 | } 65 | entries { 66 | group { 67 | name('authenticated') 68 | permissions([ 'Job/Build', 'Job/Configure', 'Job/Delete', 'Job/Read' ]) 69 | } 70 | } 71 | } 72 | } 73 | } -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/configuration-as-code-v2.yml: -------------------------------------------------------------------------------- 1 | jenkins: 2 | authorizationStrategy: 3 | projectMatrix: 4 | permissions: 5 | - "GROUP:Agent/Build:authenticated" 6 | - "GROUP:Agent/Configure:authenticated" 7 | - "GROUP:Agent/Connect:authenticated" 8 | - "GROUP:Agent/Create:authenticated" 9 | - "GROUP:Agent/Delete:authenticated" 10 | - "GROUP:Agent/Disconnect:authenticated" 11 | - "GROUP:Credentials/Create:authenticated" 12 | - "GROUP:Credentials/Delete:authenticated" 13 | - "GROUP:Credentials/ManageDomains:authenticated" 14 | - "GROUP:Credentials/Update:authenticated" 15 | - "GROUP:Credentials/View:authenticated" 16 | - "GROUP:Job/Build:authenticated" 17 | - "GROUP:Job/Cancel:authenticated" 18 | - "GROUP:Job/Configure:authenticated" 19 | - "GROUP:Job/Create:authenticated" 20 | - "GROUP:Job/Delete:authenticated" 21 | - "GROUP:Job/Discover:authenticated" 22 | - "GROUP:Job/Move:authenticated" 23 | - "GROUP:Job/Read:authenticated" 24 | - "GROUP:Job/Workspace:authenticated" 25 | - "GROUP:Overall/Administer:authenticated" 26 | - "GROUP:Overall/Read:authenticated" 27 | - "GROUP:Run/Delete:authenticated" 28 | - "GROUP:Run/Replay:authenticated" 29 | - "GROUP:Run/Update:authenticated" 30 | - "GROUP:View/Configure:authenticated" 31 | - "GROUP:View/Create:authenticated" 32 | - "GROUP:View/Delete:authenticated" 33 | - "GROUP:View/Read:authenticated" 34 | - "USER:Overall/Read:anonymous" 35 | nodes: 36 | - permanent: 37 | launcher: 38 | jnlp: 39 | workDirSettings: 40 | disabled: false 41 | failIfWorkDirIsMissing: false 42 | internalDir: "remoting" 43 | name: "agent1" 44 | nodeProperties: 45 | - authorizationMatrix: 46 | inheritanceStrategy: "inheritingGlobal" 47 | permissions: 48 | - "GROUP:Agent/Disconnect:authenticated" 49 | - "GROUP:Agent/Build:authenticated" 50 | - "USER:Agent/Build:anonymous" 51 | numExecutors: 1 52 | retentionStrategy: "always" 53 | securityRealm: 54 | local: 55 | allowsSignup: true 56 | enableCaptcha: false 57 | jobs: 58 | - script: > 59 | folder('generated') { 60 | properties { 61 | authorizationMatrix { 62 | inheritanceStrategy { 63 | nonInheriting() 64 | } 65 | entries { 66 | group { 67 | name('authenticated') 68 | permissions([ 'Job/Build', 'Job/Configure', 'Job/Delete', 'Job/Read' ]) 69 | } 70 | } 71 | } 72 | } 73 | } -------------------------------------------------------------------------------- /src/test/java/org/jenkinsci/plugins/matrixauth/AuthorizationContainerDescriptorTest.java: -------------------------------------------------------------------------------- 1 | package org.jenkinsci.plugins.matrixauth; 2 | 3 | import static org.junit.jupiter.api.Assertions.assertFalse; 4 | import static org.junit.jupiter.api.Assertions.assertTrue; 5 | 6 | import hudson.model.Item; 7 | import hudson.model.Run; 8 | import hudson.security.GlobalMatrixAuthorizationStrategy; 9 | import hudson.security.Permission; 10 | import hudson.security.PermissionScope; 11 | import jenkins.model.Jenkins; 12 | import org.junit.jupiter.api.Test; 13 | import org.jvnet.localizer.Localizable; 14 | import org.jvnet.localizer.ResourceBundleHolder; 15 | 16 | class AuthorizationContainerDescriptorTest { 17 | 18 | private static final Permission TEST_PERMISSION = new Permission( 19 | Item.PERMISSIONS, 20 | "Test", 21 | new Localizable(ResourceBundleHolder.get(AuthorizationContainerDescriptorTest.class), "Test"), 22 | Item.BUILD, 23 | PermissionScope.ITEM); 24 | 25 | @Test 26 | void testImpliedNotes() { 27 | { // no message on Administer 28 | String description = 29 | new GlobalMatrixAuthorizationStrategy.DescriptorImpl().getDescription(Jenkins.ADMINISTER); 30 | assertFalse(description.contains(Messages.GlobalMatrixAuthorizationStrategy_PermissionNotImpliedBy())); 31 | assertFalse(description.contains(Messages.GlobalMatrixAuthorizationStrategy_PermissionImpliedBy( 32 | Jenkins.PERMISSIONS.title.toString(), Jenkins.ADMINISTER.name))); 33 | } 34 | 35 | { // Run.ARTIFACTS is not implied by other permissions 36 | String description = new GlobalMatrixAuthorizationStrategy.DescriptorImpl().getDescription(Run.ARTIFACTS); 37 | assertTrue(description.contains(Messages.GlobalMatrixAuthorizationStrategy_PermissionNotImpliedBy())); 38 | assertFalse(description.contains(Messages.GlobalMatrixAuthorizationStrategy_PermissionImpliedBy( 39 | Jenkins.PERMISSIONS.title.toString(), Jenkins.ADMINISTER.name))); 40 | } 41 | 42 | { 43 | // Use a fake permission for the 'implied by' message addition check, since Item.CANCEL changed behavior in 44 | // 2.120, and there's no permission left with the same behavior. 45 | String description = new GlobalMatrixAuthorizationStrategy.DescriptorImpl().getDescription(TEST_PERMISSION); 46 | assertFalse(description.contains(Messages.GlobalMatrixAuthorizationStrategy_PermissionNotImpliedBy())); 47 | assertTrue(description.contains(Messages.GlobalMatrixAuthorizationStrategy_PermissionImpliedBy( 48 | Item.PERMISSIONS.title.toString(), Item.BUILD.name))); 49 | } 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/integrations/casc/GlobalMatrixAuthorizationStrategyConfigurator.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2018-2022 CloudBees, Inc., Nicolas De Loof, Daniel Beck, Basil Crow 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.integrations.casc; 25 | 26 | import edu.umd.cs.findbugs.annotations.CheckForNull; 27 | import edu.umd.cs.findbugs.annotations.NonNull; 28 | import hudson.Extension; 29 | import hudson.security.GlobalMatrixAuthorizationStrategy; 30 | import io.jenkins.plugins.casc.ConfigurationContext; 31 | import io.jenkins.plugins.casc.model.CNode; 32 | import io.jenkins.plugins.casc.model.Mapping; 33 | import org.kohsuke.accmod.Restricted; 34 | import org.kohsuke.accmod.restrictions.NoExternalUse; 35 | 36 | @Extension(optional = true, ordinal = 2) 37 | @Restricted(NoExternalUse.class) 38 | public class GlobalMatrixAuthorizationStrategyConfigurator 39 | extends MatrixAuthorizationStrategyConfigurator { 40 | 41 | @Override 42 | @NonNull 43 | public String getName() { 44 | return "globalMatrix"; 45 | } 46 | 47 | @Override 48 | public Class getTarget() { 49 | return GlobalMatrixAuthorizationStrategy.class; 50 | } 51 | 52 | @Override 53 | public GlobalMatrixAuthorizationStrategy instance(Mapping mapping, ConfigurationContext context) { 54 | return new GlobalMatrixAuthorizationStrategy(); 55 | } 56 | 57 | @CheckForNull 58 | @Override 59 | public CNode describe(GlobalMatrixAuthorizationStrategy instance, ConfigurationContext context) throws Exception { 60 | return compare(instance, new GlobalMatrixAuthorizationStrategy(), context); 61 | } 62 | } 63 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/integrations/casc/ProjectMatrixAuthorizationStrategyConfigurator.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2018-2022 CloudBees, Inc., Nicolas De Loof, Daniel Beck, Basil Crow 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.integrations.casc; 25 | 26 | import edu.umd.cs.findbugs.annotations.CheckForNull; 27 | import edu.umd.cs.findbugs.annotations.NonNull; 28 | import hudson.Extension; 29 | import hudson.security.ProjectMatrixAuthorizationStrategy; 30 | import io.jenkins.plugins.casc.ConfigurationContext; 31 | import io.jenkins.plugins.casc.model.CNode; 32 | import io.jenkins.plugins.casc.model.Mapping; 33 | import org.kohsuke.accmod.Restricted; 34 | import org.kohsuke.accmod.restrictions.NoExternalUse; 35 | 36 | @Extension(optional = true, ordinal = 2) 37 | @Restricted(NoExternalUse.class) 38 | public class ProjectMatrixAuthorizationStrategyConfigurator 39 | extends MatrixAuthorizationStrategyConfigurator { 40 | 41 | @Override 42 | @NonNull 43 | public String getName() { 44 | return "projectMatrix"; 45 | } 46 | 47 | @Override 48 | public Class getTarget() { 49 | return ProjectMatrixAuthorizationStrategy.class; 50 | } 51 | 52 | @Override 53 | public ProjectMatrixAuthorizationStrategy instance(Mapping mapping, ConfigurationContext context) { 54 | return new ProjectMatrixAuthorizationStrategy(); 55 | } 56 | 57 | @CheckForNull 58 | @Override 59 | public CNode describe(ProjectMatrixAuthorizationStrategy instance, ConfigurationContext context) throws Exception { 60 | return compare(instance, new ProjectMatrixAuthorizationStrategy(), context); 61 | } 62 | } 63 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/configuration-as-code-v3.yml: -------------------------------------------------------------------------------- 1 | jenkins: 2 | authorizationStrategy: 3 | projectMatrix: 4 | entries: 5 | - group: 6 | name: authenticated 7 | permissions: 8 | - Agent/Build 9 | - Agent/Configure 10 | - Agent/Connect 11 | - Agent/Create 12 | - Agent/Delete 13 | - Agent/Disconnect 14 | - Credentials/Create 15 | - Credentials/Delete 16 | - Credentials/ManageDomains 17 | - Credentials/Update 18 | - Credentials/View 19 | - Job/Build 20 | - Job/Cancel 21 | - Job/Configure 22 | - Job/Create 23 | - Job/Delete 24 | - Job/Discover 25 | - Job/Move 26 | - Job/Read 27 | - Job/Workspace 28 | - Overall/Administer 29 | - Overall/Read 30 | - Run/Delete 31 | - Run/Replay 32 | - Run/Update 33 | - View/Configure 34 | - View/Create 35 | - View/Delete 36 | - View/Read 37 | - user: 38 | name: anonymous 39 | permissions: 40 | - Overall/Read 41 | - userOrGroup: 42 | name: developer 43 | permissions: 44 | - Overall/Read 45 | nodes: 46 | - permanent: 47 | launcher: 48 | jnlp: 49 | workDirSettings: 50 | disabled: false 51 | failIfWorkDirIsMissing: false 52 | internalDir: "remoting" 53 | name: "agent1" 54 | nodeProperties: 55 | - authorizationMatrix: 56 | inheritanceStrategy: "inheritingGlobal" 57 | entries: 58 | - group: 59 | name: authenticated 60 | permissions: 61 | - Agent/Disconnect 62 | - Agent/Build 63 | - user: 64 | name: anonymous 65 | permissions: 66 | - Agent/Build 67 | - userOrGroup: 68 | name: developer 69 | permissions: 70 | - Agent/Configure 71 | numExecutors: 1 72 | retentionStrategy: "always" 73 | securityRealm: 74 | local: 75 | allowsSignup: true 76 | enableCaptcha: false 77 | jobs: 78 | - script: > 79 | folder('generated') { 80 | properties { 81 | authorizationMatrix { 82 | inheritanceStrategy { 83 | nonInheriting() 84 | } 85 | entries { 86 | group { 87 | name('authenticated') 88 | permissions([ 'Job/Build', 'Job/Configure', 'Job/Delete', 'Job/Read' ]) 89 | } 90 | } 91 | } 92 | } 93 | } -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/ExportTest/exportTestLegacy/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 2.138.3 5 | DEVELOPMENT 6 | 2 7 | NORMAL 8 | true 9 | 10 | com.cloudbees.plugins.credentials.CredentialsProvider.Create:authenticated 11 | com.cloudbees.plugins.credentials.CredentialsProvider.ManageDomains:authenticated 12 | com.cloudbees.plugins.credentials.CredentialsProvider.View:authenticated 13 | hudson.model.Computer.Build:authenticated 14 | hudson.model.Computer.Connect:authenticated 15 | hudson.model.Computer.Create:authenticated 16 | hudson.model.Computer.Delete:authenticated 17 | hudson.model.Computer.Disconnect:authenticated 18 | hudson.model.Hudson.Administer:anonymous 19 | hudson.model.Hudson.Administer:authenticated 20 | hudson.model.Item.Build:authenticated 21 | hudson.model.Item.Cancel:authenticated 22 | hudson.model.Item.Configure:authenticated 23 | hudson.model.Item.Read:authenticated 24 | hudson.model.Run.Delete:authenticated 25 | hudson.model.Run.Update:authenticated 26 | hudson.model.View.Configure:authenticated 27 | hudson.model.View.Delete:authenticated 28 | 29 | 30 | false 31 | false 32 | 33 | false 34 | 35 | ${JENKINS_HOME}/workspace/${ITEM_FULL_NAME} 36 | ${ITEM_ROOTDIR}/builds 37 | 38 | 39 | 40 | 41 | 42 | 5 43 | 0 44 | 45 | 46 | 47 | all 48 | false 49 | false 50 | 51 | 52 | 53 | all 54 | 0 55 | 56 | 57 | 58 | -------------------------------------------------------------------------------- /src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/ExportTest/exportTest/config.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 2.138.3 5 | DEVELOPMENT 6 | 2 7 | NORMAL 8 | true 9 | 10 | GROUP:com.cloudbees.plugins.credentials.CredentialsProvider.Create:authenticated 11 | GROUP:com.cloudbees.plugins.credentials.CredentialsProvider.ManageDomains:authenticated 12 | GROUP:com.cloudbees.plugins.credentials.CredentialsProvider.View:authenticated 13 | GROUP:hudson.model.Computer.Build:authenticated 14 | GROUP:hudson.model.Computer.Connect:authenticated 15 | GROUP:hudson.model.Computer.Create:authenticated 16 | GROUP:hudson.model.Computer.Delete:authenticated 17 | GROUP:hudson.model.Computer.Disconnect:authenticated 18 | USER:hudson.model.Hudson.Administer:anonymous 19 | GROUP:hudson.model.Hudson.Administer:authenticated 20 | GROUP:hudson.model.Item.Build:authenticated 21 | GROUP:hudson.model.Item.Cancel:authenticated 22 | GROUP:hudson.model.Item.Configure:authenticated 23 | GROUP:hudson.model.Item.Read:authenticated 24 | GROUP:hudson.model.Run.Delete:authenticated 25 | GROUP:hudson.model.Run.Update:authenticated 26 | GROUP:hudson.model.View.Configure:authenticated 27 | GROUP:hudson.model.View.Delete:authenticated 28 | 29 | 30 | false 31 | false 32 | 33 | false 34 | 35 | ${JENKINS_HOME}/workspace/${ITEM_FULL_NAME} 36 | ${ITEM_ROOTDIR}/builds 37 | 38 | 39 | 40 | 41 | 42 | 5 43 | 0 44 | 45 | 46 | 47 | all 48 | false 49 | false 50 | 51 | 52 | 53 | all 54 | 0 55 | 56 | 57 | 58 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/integrations/PermissionFinder.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2018 Configuration as Code Plugin Developers 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.integrations; 25 | 26 | import edu.umd.cs.findbugs.annotations.CheckForNull; 27 | import hudson.security.Permission; 28 | import hudson.security.PermissionGroup; 29 | import java.util.List; 30 | import java.util.regex.Matcher; 31 | import java.util.regex.Pattern; 32 | import org.kohsuke.accmod.Restricted; 33 | import org.kohsuke.accmod.restrictions.NoExternalUse; 34 | 35 | /** 36 | * Implements lookup for {@link Permission}s. 37 | */ 38 | // Imported from 39 | // https://github.com/jenkinsci/configuration-as-code-plugin/blob/727c976d137461f146b301f302d1552ca81de75e/plugin/src/main/java/io/jenkins/plugins/casc/util/PermissionFinder.java 40 | @Restricted(NoExternalUse.class) 41 | public class PermissionFinder { 42 | 43 | /** For Matrix Auth - Title/Permission **/ 44 | private static final Pattern PERMISSION_PATTERN = Pattern.compile("^([^/]+)/(.+)$"); 45 | 46 | /** 47 | * Attempt to match a given permission to what is defined in the UI. 48 | * @param id String of the form "Title/Permission" (Look in the UI) for a particular permission 49 | * @return a matched permission 50 | */ 51 | @CheckForNull 52 | public static Permission findPermission(String id) { 53 | final String resolvedId = findPermissionId(id); 54 | return resolvedId != null ? Permission.fromId(resolvedId) : null; 55 | } 56 | 57 | /** 58 | * Attempt to match a given permission to what is defined in the UI. 59 | * @param id String of the form "Title/Permission" (Look in the UI) for a particular permission 60 | * @return a matched permission ID 61 | */ 62 | @CheckForNull 63 | public static String findPermissionId(String id) { 64 | List pgs = PermissionGroup.getAll(); 65 | Matcher m = PERMISSION_PATTERN.matcher(id); 66 | if (m.matches()) { 67 | String owner = m.group(1); 68 | String name = m.group(2); 69 | for (PermissionGroup pg : pgs) { 70 | if (pg.owner.equals(Permission.class)) { 71 | continue; 72 | } 73 | if (pg.getId().equals(owner)) { 74 | return pg.owner.getName() + "." + name; 75 | } 76 | } 77 | } 78 | return null; 79 | } 80 | } 81 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/inheritance/InheritanceStrategy.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2017 Daniel Beck 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.inheritance; 25 | 26 | import edu.umd.cs.findbugs.annotations.CheckForNull; 27 | import edu.umd.cs.findbugs.annotations.NonNull; 28 | import hudson.ExtensionPoint; 29 | import hudson.model.AbstractDescribableImpl; 30 | import hudson.model.AbstractItem; 31 | import hudson.model.ItemGroup; 32 | import hudson.security.ACL; 33 | import hudson.security.AccessControlled; 34 | import hudson.security.Permission; 35 | import jenkins.model.Jenkins; 36 | import jenkins.util.SystemProperties; 37 | import org.kohsuke.accmod.Restricted; 38 | import org.kohsuke.accmod.restrictions.NoExternalUse; 39 | import org.springframework.security.core.Authentication; 40 | 41 | public abstract class InheritanceStrategy extends AbstractDescribableImpl 42 | implements ExtensionPoint { 43 | @Restricted(NoExternalUse.class) 44 | /* package */ static boolean isParentReadPermissionRequired() { 45 | return SystemProperties.getBoolean( 46 | hudson.security.AuthorizationMatrixProperty.class.getName() + ".checkParentPermissions", true); 47 | } 48 | 49 | @Override 50 | public InheritanceStrategyDescriptor getDescriptor() { 51 | return (InheritanceStrategyDescriptor) super.getDescriptor(); 52 | } 53 | 54 | @CheckForNull 55 | private ACL getParentItemACL(AccessControlled accessControlled) { 56 | ACL parentACL = null; 57 | if (accessControlled instanceof AbstractItem) { 58 | AbstractItem item = (AbstractItem) accessControlled; 59 | ItemGroup parent = item.getParent(); 60 | if (parent instanceof AbstractItem) { 61 | parentACL = Jenkins.get().getAuthorizationStrategy().getACL((AbstractItem) parent); 62 | } 63 | } 64 | return parentACL; 65 | } 66 | 67 | public ACL getEffectiveACL(final ACL acl, final AccessControlled subject) { 68 | return ACL.lambda2((a, p) -> hasPermission( 69 | a, 70 | p, 71 | acl, 72 | getParentItemACL(subject), 73 | Jenkins.get().getAuthorizationStrategy().getRootACL())); 74 | } 75 | 76 | protected abstract boolean hasPermission( 77 | @NonNull Authentication a, @NonNull Permission permission, ACL child, @CheckForNull ACL parent, ACL root); 78 | } 79 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/integrations/casc/AuthorizationMatrixNodePropertyConfigurator.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2018-2019 Matrix Authorization Strategy Plugin developers 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.integrations.casc; 25 | 26 | import edu.umd.cs.findbugs.annotations.NonNull; 27 | import hudson.Extension; 28 | import io.jenkins.plugins.casc.Attribute; 29 | import io.jenkins.plugins.casc.BaseConfigurator; 30 | import io.jenkins.plugins.casc.ConfigurationContext; 31 | import io.jenkins.plugins.casc.impl.attributes.DescribableAttribute; 32 | import io.jenkins.plugins.casc.impl.attributes.MultivaluedAttribute; 33 | import io.jenkins.plugins.casc.model.Mapping; 34 | import java.util.Arrays; 35 | import java.util.HashSet; 36 | import java.util.Set; 37 | import org.jenkinsci.plugins.matrixauth.AuthorizationMatrixNodeProperty; 38 | import org.jenkinsci.plugins.matrixauth.inheritance.InheritanceStrategy; 39 | import org.kohsuke.accmod.Restricted; 40 | import org.kohsuke.accmod.restrictions.NoExternalUse; 41 | 42 | @Extension(optional = true) 43 | @Restricted(NoExternalUse.class) 44 | public class AuthorizationMatrixNodePropertyConfigurator extends BaseConfigurator { 45 | 46 | @Override 47 | public Class getTarget() { 48 | return AuthorizationMatrixNodeProperty.class; 49 | } 50 | 51 | @Override 52 | protected AuthorizationMatrixNodeProperty instance(Mapping mapping, ConfigurationContext context) { 53 | return new AuthorizationMatrixNodeProperty(); 54 | } 55 | 56 | @Override 57 | @NonNull 58 | public Set> describe() { 59 | return new HashSet<>(Arrays.asList( 60 | new MultivaluedAttribute("permissions", String.class) 61 | .getter(unused -> null) 62 | .setter(MatrixAuthorizationStrategyConfigurator::setLegacyPermissions), 63 | new MultivaluedAttribute( 64 | "entries", DefinitionEntry.class) 65 | .getter(MatrixAuthorizationStrategyConfigurator::getEntries) 66 | .setter(MatrixAuthorizationStrategyConfigurator::setEntries), 67 | new DescribableAttribute( 68 | "inheritanceStrategy", InheritanceStrategy.class))); 69 | } 70 | } 71 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Matrix Authorization Strategy Plugin 2 | 3 | Implement fine-grained access control in Jenkins with this plugin. 4 | 5 | For a basic introduction, see [the section on Matrix Authorization in the Jenkins handbook](https://jenkins.io/doc/book/managing/security/#authorization). 6 | 7 | ## Changelog 8 | 9 | See [GitHub Releases](https://github.com/jenkinsci/matrix-auth-plugin/releases) (2.6.5 and newer only) or [CHANGELOG](CHANGELOG.md) (before 3.0 only). 10 | 11 | ## Use Cases 12 | 13 | Matrix Authorization allows configuring the lowest level permissions, such as starting new builds, configuring items, or deleting them, individually. 14 | 15 | ### Project-based configuration 16 | 17 | Project-based matrix authorization allows configuring permissions for each item or agent independently. 18 | Permission applying to such items or agents that are granted in the global configuration apply to all of them, unless they don't inherit global permissions (see below). 19 | 20 | ### Permission inheritance 21 | 22 | With project-based matrix authorization, permissions are by inherited from the global configuration and any parent entities (e.g. the folder a job is in) by default. 23 | This can be changed. 24 | Depending on the entity being configured, all or a subset of the following _inheritance strategies_ are available: 25 | 26 | * Inherit permissions: 27 | This is the default behavior. 28 | Permissions explicitly granted on individual items or agents will only add to permissions defined globally or in any parent items. 29 | * Inherit global configuration only: 30 | This will only inherit permissions granted globally, but not those granted on parent folders. 31 | This way, jobs in folders can control access independently from their parent folder. 32 | * Do not inherit permissions: 33 | The most restrictive inheritance configuration. 34 | Only permissions defined explicitly on this agent or item will be granted. 35 | The only exception is Overall/Administer: 36 | It is not possible to remove access to an agent or item from Jenkins administrators. 37 | 38 | ### Configuration as Code and Job DSL support 39 | 40 | Matrix Authorization Strategy Plugin has full support for use in Configuration as Code and Job DSL. 41 | 42 | For an example combining the two, see [this `configuration-as-code.yml` test resource](https://github.com/jenkinsci/matrix-auth-plugin/blob/master/src/test/resources/org/jenkinsci/plugins/matrixauth/integrations/casc/configuration-as-code-v3.yml). 43 | 44 | 45 | ## Caveats 46 | 47 | When using project-based matrix authorization, users granted permission to configure items or agents will be able to grant themselves all other permissions on the item or agent. 48 | These would be inherited unless specifically disabled. 49 | 50 | Beyond the above, administrators implementing fine-grained permissions control need to be aware of interactions between permissions, and certain overlap between them. 51 | Some examples: 52 | 53 | * A user not granted read access to Jenkins in general will not be able to use most of the other permissions they've been granted -- likely none of them. 54 | * A user not granted read access to a job will not be able to start new builds, delete the job, configure the job, etc. 55 | * When using global matrix authorization, users granted permission to configure jobs but not start them will still be able to configure the job to be periodically executed. 56 | * Some permissions imply others. 57 | Most notably, Overall/Administer implies (almost) all other permissions, but other implications exist: 58 | For example, Job/Read implies Job/Discover. 59 | Descriptions for permissions will note when a permission is either implied by a permission other than Overall/Administer, or when it is not implied by any other permission. 60 | -------------------------------------------------------------------------------- /src/test/java/org/jenkinsci/plugins/matrixauth/AuthorizationMatrixNodePropertyTest.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright 2017 Daniel Beck 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | 25 | package org.jenkinsci.plugins.matrixauth; 26 | 27 | import static org.junit.jupiter.api.Assertions.*; 28 | 29 | import hudson.model.Computer; 30 | import hudson.model.Node; 31 | import hudson.model.User; 32 | import hudson.security.ACL; 33 | import hudson.security.ACLContext; 34 | import hudson.security.HudsonPrivateSecurityRealm; 35 | import hudson.security.ProjectMatrixAuthorizationStrategy; 36 | import java.util.Collections; 37 | import java.util.Objects; 38 | import jenkins.model.Jenkins; 39 | import org.junit.jupiter.api.BeforeEach; 40 | import org.junit.jupiter.api.Test; 41 | import org.jvnet.hudson.test.JenkinsRule; 42 | import org.jvnet.hudson.test.junit.jupiter.WithJenkins; 43 | 44 | @WithJenkins 45 | class AuthorizationMatrixNodePropertyTest { 46 | 47 | private JenkinsRule j; 48 | 49 | @BeforeEach 50 | void setUp(JenkinsRule rule) { 51 | j = rule; 52 | } 53 | 54 | @Test 55 | void ensureCreatorHasPermissions() throws Exception { 56 | HudsonPrivateSecurityRealm realm = new HudsonPrivateSecurityRealm(false, false, null); 57 | realm.createAccount("alice", "alice"); 58 | realm.createAccount("bob", "bob"); 59 | j.jenkins.setSecurityRealm(realm); 60 | 61 | ProjectMatrixAuthorizationStrategy authorizationStrategy = new ProjectMatrixAuthorizationStrategy(); 62 | authorizationStrategy.add(Computer.CREATE, PermissionEntry.user("alice")); 63 | authorizationStrategy.add(Jenkins.READ, PermissionEntry.user("alice")); 64 | 65 | addRunScriptsPermission(authorizationStrategy); 66 | j.jenkins.setAuthorizationStrategy(authorizationStrategy); 67 | 68 | Node node; 69 | try (ACLContext ignored = ACL.as(User.get("alice", false, Collections.emptyMap()))) { 70 | node = j.createSlave(); 71 | } 72 | 73 | assertNotNull(node.getNodeProperty(AuthorizationMatrixNodeProperty.class)); 74 | assertTrue(node.getACL() 75 | .hasPermission2( 76 | Objects.requireNonNull(User.get("alice", false, Collections.emptyMap())) 77 | .impersonate2(), 78 | Computer.CONFIGURE)); 79 | assertFalse(node.getACL() 80 | .hasPermission2( 81 | Objects.requireNonNull(User.get("bob", false, Collections.emptyMap())) 82 | .impersonate2(), 83 | Computer.CONFIGURE)); 84 | } 85 | 86 | // createSlave uses CommandLauncher, which requires RUN_SCRIPTS since 2.73.2 87 | @SuppressWarnings("deprecation") 88 | private void addRunScriptsPermission(ProjectMatrixAuthorizationStrategy authorizationStrategy) { 89 | authorizationStrategy.add(Jenkins.RUN_SCRIPTS, PermissionEntry.user("alice")); 90 | } 91 | } 92 | -------------------------------------------------------------------------------- /src/main/resources/hudson/security/table.css: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Seiji Sogabe 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | .global-matrix-authorization-strategy-table { 25 | border-spacing: 2px 26 | } 27 | 28 | .global-matrix-authorization-strategy-table tbody>tr>td { 29 | height: 30px; 30 | } 31 | 32 | .global-matrix-authorization-strategy-table th, .global-matrix-authorization-strategy-table td 33 | { 34 | padding: 0 0.25rem!important; 35 | vertical-align: middle; 36 | text-align: center; 37 | } 38 | 39 | .global-matrix-authorization-strategy-table .caption-row TH { 40 | padding: 0.25rem!important; 41 | width: 1rem; 42 | text-align: center; 43 | } 44 | 45 | .global-matrix-authorization-strategy-table .caption-row TH span { 46 | writing-mode: vertical-rl; 47 | padding: 5px 0; 48 | font-weight: lighter; 49 | } 50 | 51 | .global-matrix-authorization-strategy-table TD.left-most { 52 | text-align: left; 53 | } 54 | 55 | .global-matrix-authorization-strategy-table TD.stop { 56 | white-space: nowrap; 57 | } 58 | 59 | .matrix-auth-add-user-button { 60 | margin: 10px; 61 | } 62 | 63 | @keyframes highlightentry { 64 | from { background: #C4C080; } 65 | to { background: transparent; } 66 | } 67 | 68 | .highlight-entry { 69 | -webkit-animation: highlightentry 5s; 70 | -moz-animation: highlightentry 5s; 71 | animation: highlightentry 5s; 72 | } 73 | 74 | .global-matrix-authorization-strategy-table .jenkins-checkbox { 75 | vertical-align: middle; 76 | } 77 | 78 | .mas-table__cell { 79 | display: flex; 80 | align-items: center; 81 | gap: 3px; 82 | } 83 | 84 | .mas-table__cell svg { 85 | min-width: 16px; 86 | } 87 | 88 | .mas-table__cell a { 89 | height: 16px; 90 | color: var(--text-color) 91 | } 92 | 93 | .mas-table__cell a svg { 94 | vertical-align: initial!important; 95 | } 96 | 97 | .mas-table__cell--not-found { 98 | text-decoration: line-through; 99 | color: var(--danger); 100 | font-weight: 600; 101 | } 102 | 103 | .mas-table__cell-warning { 104 | color: var(--warning); 105 | font-weight: 600; 106 | } 107 | 108 | .mas-table__icon-warning { 109 | color: var(--warning); 110 | min-width: 24px!important; 111 | } 112 | 113 | .mas-table__icon-alert { 114 | color: var(--danger); 115 | min-width: 24px!important; 116 | } 117 | 118 | .mas-table__header { 119 | vertical-align: bottom!important; 120 | text-align: left!important; 121 | } 122 | 123 | .mas-table__header-th { 124 | text-align: center!important; 125 | background: var(--table-body-background); 126 | } 127 | 128 | .mas-table__header-th.first { 129 | border-top-left-radius: var(--table-border-radius); 130 | } 131 | 132 | .mas-table__header-th.last { 133 | border-top-right-radius: var(--table-border-radius); 134 | } 135 | 136 | .mas-table__permission { 137 | background: var(--table-body-background); 138 | } -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/inheritance/InheritParentStrategy.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2017 Daniel Beck 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.inheritance; 25 | 26 | import edu.umd.cs.findbugs.annotations.CheckForNull; 27 | import edu.umd.cs.findbugs.annotations.NonNull; 28 | import hudson.Extension; 29 | import hudson.model.AbstractItem; 30 | import hudson.model.Item; 31 | import hudson.security.ACL; 32 | import hudson.security.Permission; 33 | import org.jenkinsci.Symbol; 34 | import org.kohsuke.stapler.DataBoundConstructor; 35 | import org.springframework.security.core.Authentication; 36 | 37 | /** 38 | * Strategy that inherits the ACL from the parent. 39 | * 40 | * The parent's inheritance strategy in turn determines whether this receives permissions from grandparents etc. up to root. 41 | */ 42 | public class InheritParentStrategy extends InheritanceStrategy { 43 | 44 | @DataBoundConstructor 45 | public InheritParentStrategy() {} 46 | 47 | @Override 48 | protected boolean hasPermission( 49 | @NonNull Authentication a, @NonNull Permission permission, ACL child, @CheckForNull ACL parent, ACL root) { 50 | if (a.equals(ACL.SYSTEM2)) { 51 | return true; 52 | } 53 | if (isParentReadPermissionRequired() 54 | && parent != null 55 | && (Item.READ.equals(permission) || Item.DISCOVER.equals(permission))) { 56 | /* 57 | * If we have an item parent, only grant Item/Read and Item/Discover if it's granted on the parent. 58 | * In this case, it doesn't even matter whether it's explicitly granted on the child. 59 | */ 60 | return parent.hasPermission2(a, permission); 61 | } 62 | if (parent == null) { 63 | /* 64 | * Without an item parent (i.e. topmost level item) we need to check both grants on this item, as 65 | * well as grants on the root (parent) ACL: 66 | * - Explicitly granted here but possibly not globally (on root): That's OK 67 | * - NOT explicitly granted here, but globally: That's also OK 68 | */ 69 | return root.hasPermission2(a, permission) || child.hasPermission2(a, permission); 70 | } else { 71 | /* If we have an item parent, check both explicit grants here and inherited permissions from parent. */ 72 | return parent.hasPermission2(a, permission) || child.hasPermission2(a, permission); 73 | } 74 | } 75 | 76 | @Symbol("inheriting") 77 | @Extension(ordinal = 100) 78 | public static class DescriptorImpl extends InheritanceStrategyDescriptor { 79 | 80 | @Override 81 | public boolean isApplicable(Class clazz) { 82 | return AbstractItem.class.isAssignableFrom(clazz); 83 | } 84 | 85 | @Override 86 | @NonNull 87 | public String getDisplayName() { 88 | return Messages.InheritParentStrategy_DisplayName(); 89 | } 90 | } 91 | } 92 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/inheritance/InheritGlobalStrategy.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2017 Daniel Beck 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.inheritance; 25 | 26 | import edu.umd.cs.findbugs.annotations.CheckForNull; 27 | import edu.umd.cs.findbugs.annotations.NonNull; 28 | import hudson.Extension; 29 | import hudson.model.Item; 30 | import hudson.security.ACL; 31 | import hudson.security.Permission; 32 | import org.jenkinsci.Symbol; 33 | import org.kohsuke.stapler.DataBoundConstructor; 34 | import org.springframework.security.core.Authentication; 35 | 36 | /** 37 | * Strategy that inherits only the global ACL -- parent, grandparent, etc. ACLs are not inherited. 38 | */ 39 | public class InheritGlobalStrategy extends InheritanceStrategy { 40 | 41 | @DataBoundConstructor 42 | public InheritGlobalStrategy() {} 43 | 44 | @Override 45 | protected boolean hasPermission( 46 | @NonNull Authentication a, @NonNull Permission permission, ACL child, @CheckForNull ACL parent, ACL root) { 47 | if (a.equals(ACL.SYSTEM2)) { 48 | return true; 49 | } 50 | if (isParentReadPermissionRequired() 51 | && parent != null 52 | && (Item.READ.equals(permission) || Item.DISCOVER.equals(permission))) { 53 | /* 54 | * We need special handling for Read/Discover permissions to prevent SECURITY-2180: 55 | * Item/Read is expected to only be effective if it is granted on every ancestor, similar to how permissions 56 | * granted while lacking Overall/Read are pointless. 57 | * If and only if we check for Item/Read or Item/Discover, do not fall back to the permission granted globally. 58 | * No need to check #isUltimatelyImpliedByAdminister like NonInheritingStrategy does, we know it to be true for these permissions. 59 | * 60 | * This is a nested element. 61 | * We need to ensure that all of the following are true: 62 | * - The permission is granted in the parent 63 | * - The permission is granted globally or explicitly on this element (the child) 64 | */ 65 | final boolean grantedViaChild = child.hasPermission2(a, permission); 66 | final boolean grantedGlobally = root.hasPermission2(a, permission); 67 | final boolean grantedInParent = parent.hasPermission2(a, permission); 68 | return (grantedViaChild || grantedGlobally) && grantedInParent; 69 | } 70 | return child.hasPermission2(a, permission) || root.hasPermission2(a, permission); 71 | } 72 | 73 | @Symbol("inheritingGlobal") 74 | @Extension 75 | public static class DescriptorImpl extends InheritanceStrategyDescriptor { 76 | 77 | @Override 78 | public boolean isApplicable(Class clazz) { 79 | return true; 80 | } 81 | 82 | @Override 83 | @NonNull 84 | public String getDisplayName() { 85 | return Messages.InheritGlobalStrategy_DisplayName(); 86 | } 87 | } 88 | } 89 | -------------------------------------------------------------------------------- /pom.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4.0.0 4 | 5 | 6 | org.jenkins-ci.plugins 7 | plugin 8 | 5.22 9 | 10 | 11 | matrix-auth 12 | ${revision}${changelist} 13 | hpi 14 | 15 | Matrix Authorization Strategy Plugin 16 | https://github.com/jenkinsci/matrix-auth-plugin 17 | 18 | 19 | 20 | MIT 21 | https://opensource.org/licenses/MIT 22 | 23 | 24 | 25 | 26 | scm:git:https://github.com/${gitHubRepo}.git 27 | scm:git:git@github.com:${gitHubRepo}.git 28 | ${scmTag} 29 | https://github.com/${gitHubRepo} 30 | 31 | 32 | 33 | 3.2.10 34 | -SNAPSHOT 35 | 36 | 2.479 37 | ${jenkins.baseline}.3 38 | 39 | false 40 | jenkinsci/${project.artifactId}-plugin 41 | 3.2 42 | true 43 | false 44 | 45 | 46 | 47 | 48 | 49 | io.jenkins.tools.bom 50 | bom-${jenkins.baseline}.x 51 | 5054.v620b_5d2b_d5e6 52 | pom 53 | import 54 | 55 | 56 | 57 | 58 | 59 | 60 | io.jenkins 61 | configuration-as-code 62 | true 63 | 64 | 65 | io.jenkins.plugins 66 | ionicons-api 67 | 68 | 69 | org.jenkins-ci.plugins 70 | cloudbees-folder 71 | true 72 | 73 | 74 | 75 | 76 | io.jenkins.configuration-as-code 77 | test-harness 78 | test 79 | 80 | 81 | org.jenkins-ci.plugins 82 | credentials 83 | test 84 | 85 | 86 | org.jenkins-ci.plugins 87 | job-dsl 88 | test 89 | 90 | 91 | org.jenkins-ci.plugins.workflow 92 | workflow-cps 93 | test 94 | 95 | 96 | org.jenkins-ci.plugins.workflow 97 | workflow-cps 98 | tests 99 | test 100 | 101 | 102 | org.jenkins-ci.plugins.workflow 103 | workflow-multibranch 104 | test 105 | 106 | 107 | 108 | 109 | 110 | repo.jenkins-ci.org 111 | https://repo.jenkins-ci.org/public/ 112 | 113 | 114 | 115 | 116 | repo.jenkins-ci.org 117 | https://repo.jenkins-ci.org/public/ 118 | 119 | 120 | 121 | -------------------------------------------------------------------------------- /src/main/java/org/jenkinsci/plugins/matrixauth/integrations/casc/PermissionDefinition.java: -------------------------------------------------------------------------------- 1 | /* 2 | * The MIT License 3 | * 4 | * Copyright (c) 2023 Daniel Beck 5 | * 6 | * Permission is hereby granted, free of charge, to any person obtaining a copy 7 | * of this software and associated documentation files (the "Software"), to deal 8 | * in the Software without restriction, including without limitation the rights 9 | * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 10 | * copies of the Software, and to permit persons to whom the Software is 11 | * furnished to do so, subject to the following conditions: 12 | * 13 | * The above copyright notice and this permission notice shall be included in 14 | * all copies or substantial portions of the Software. 15 | * 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 21 | * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN 22 | * THE SOFTWARE. 23 | */ 24 | package org.jenkinsci.plugins.matrixauth.integrations.casc; 25 | 26 | import edu.umd.cs.findbugs.annotations.NonNull; 27 | import hudson.security.Permission; 28 | import java.util.List; 29 | import java.util.Objects; 30 | import java.util.stream.Collectors; 31 | import org.apache.commons.beanutils.Converter; 32 | import org.jenkinsci.plugins.matrixauth.AuthorizationContainer; 33 | import org.kohsuke.accmod.Restricted; 34 | import org.kohsuke.accmod.restrictions.NoExternalUse; 35 | 36 | /** 37 | * Wrapper for {@link hudson.security.Permission} referenced in JCasC 38 | */ 39 | @Restricted(NoExternalUse.class) 40 | public class PermissionDefinition implements Comparable { 41 | private Permission permission; 42 | 43 | private PermissionDefinition(Permission permission) { 44 | this.permission = permission; 45 | } 46 | 47 | public Permission getPermission() { 48 | return permission; 49 | } 50 | 51 | public static PermissionDefinition forPermission(Permission permission) { 52 | return new PermissionDefinition(permission); 53 | } 54 | 55 | @Override 56 | public String toString() { 57 | return permission.group.getId() + "/" + permission.name; 58 | } 59 | 60 | @Override 61 | public boolean equals(Object o) { 62 | if (this == o) return true; 63 | if (o == null || getClass() != o.getClass()) return false; 64 | PermissionDefinition that = (PermissionDefinition) o; 65 | return Objects.equals(permission.toString(), that.permission.toString()); 66 | } 67 | 68 | @Override 69 | public int hashCode() { 70 | return Objects.hash(permission.toString()); 71 | } 72 | 73 | @Override 74 | public int compareTo(@NonNull PermissionDefinition o) { 75 | return this.toString().compareTo(o.toString()); 76 | } 77 | 78 | public static class StaplerConverterImpl implements Converter { 79 | @Override 80 | public Object convert(Class target, Object o) { 81 | if (o == null) { 82 | return null; 83 | } 84 | 85 | if (target == PermissionDefinition.class && o instanceof List) { 86 | // JCasC export provides an ArrayList and requests a PermissionDefinition !? 87 | return ((List) o) 88 | .stream() 89 | .map(p -> (PermissionDefinition) p) 90 | .map(p -> p.permission.group.getId() + "/" + p.permission.name) 91 | .collect(Collectors.toList()); 92 | } 93 | 94 | if (target == PermissionDefinition.class && o instanceof String) { 95 | // import provides a String and asks for a PermissionDefinition 96 | return PermissionDefinition.forPermission(AuthorizationContainer.parsePermission((String) o)); 97 | } 98 | 99 | throw new IllegalArgumentException("Failed to convert '" + o + "' to " + target); 100 | } 101 | } 102 | } 103 | --------------------------------------------------------------------------------