Jenkins配置基于角色的项目权限管理

Jenkins配置基于角色的项目权限管理

一．安装插件

首先需要安装三方插件：Role-Based Strategy

1.系统管理

 

2.插件管理

 

3.可选插件安装(搜索Role-Based Strategy)

 

4.插件安装成功后重启jenkins

Service jenkins restart

二．安装插件后进行系统配置

进入系统管理，后续步骤如下：

1.

 

2.

 

 

三．配置角色及角色权限

上面配置完成后，进入系统管理，就会出现Manage and Assign Roles

点击进入配置

Manage Roles：

注意：

1）job_read只加Overall的Read权限

2）job_create只加job的create权限

3）project roles中Pattern正则表达式跟脚本里的不一样，比如过滤TEST开头的jobs，要写成TEST.*而不是TEST*，切记。

 

Assign Roles：

给用户添加角色（输入用户名，点击add按钮）

注：Anonymous为匿名用户，取消该用户的所有角色，否则jenkins系统可匿名访问（不登陆也可访问）

 

Pattern处详解

pattern是在于针对匹配正则表达式的全名(包括文件夹的名称,如果你使用Cloudbees文件夹插件)将适用于的工作角色。例如：如果你在pattern处输入“Roger-.*”,这个角色将匹配所有jobs中name以”Roger-“开头。注意，这个正则表达式区别大小写的。要是不想区分大小写， 
可以使用(?i)符号:首字母大写”Roger-.” vs 小写”roger-.” vs 不区别大小写 “(?i)roger-.*”。 
如果你有一个嵌套文件夹结构,你需要提供特定的访问第二个文件夹(或深度),考虑有两级安全结构(说你想提供独家编写/修改类型访问foo / bar和没有其他“foo”:首先,分配用户/组读/发现权限模式”^ foo。”,然后分配相同的用户/组的更特定的权限模式”^ foo / bar。”——类似于Unix /Linux环境中你会做什么。

 

 以下内容参考自：http://www.cnblogs.com/davidwang456/p/3701972.html

深入了解

该插件从2011年10月发布1.1.2版本后就不再维护了，因此会有一些小问题，但不影响使用，比如在分配角色后点击保存按钮时有可能会发生异常，浏览器点击后退按钮后重新提交就可以操作成功。

另外如果配置失败导致不能登录，可以通过修改配置文件恢复初始设置。

首先了解一下配置文件。

进入jenkins安装目录，用户配置信息和角色配置信息都以配置文件的形式存储。

上图中users目录存放了各个用户的配置信息，每个用户都会创建与用户名相同的文件夹，文件夹中包含config.xml文件，配置示例如下：

 

 

    

<?xml version='1.0' encoding='UTF-8'?>     <user>       <fullName>admin</fullName>       <properties>         <jenkins.security.ApiTokenProperty>           <apiToken>EfowsOP9H5arYxMmuFrbPjjITgu/fjtvHib5okFJ9DmPTu/088cvHxlE9RHwVv+S</apiToken>         </jenkins.security.ApiTokenProperty>         <hudson.model.MyViewsProperty>           <views>             <hudson.model.AllView>               <owner class="hudson.model.MyViewsProperty" reference="http://www.cnblogs.com/.."/>               <name>All</name>               <filterExecutors>false</filterExecutors>               <filterQueue>false</filterQueue>               <properties class="hudson.model.View$PropertyList"/>             </hudson.model.AllView>           </views>         </hudson.model.MyViewsProperty>         <hudson.search.UserSearchProperty>           <insensitiveSearch>false</insensitiveSearch>         </hudson.search.UserSearchProperty>         <hudson.security.HudsonPrivateSecurityRealm_-Details>           <passwordHash>uAEYii:02e0cd0d78abf90e42b28e7d3d4fe64776ae8fa9500e379f2598cc65e1b0fb70</passwordHash>         </hudson.security.HudsonPrivateSecurityRealm_-Details>         <hudson.tasks.Mailer_-UserProperty>           <emailAddress>gaoliang@esrichina.com.cn</emailAddress>         </hudson.tasks.Mailer_-UserProperty>       </properties> </user>

 

角色配置在$Jenkins_home/config.xml文件中，示例如下：

    

<useSecurity>true</useSecurity>     <authorizationStrategy class="com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy">       <roleMap type="globalRoles">         <role name="admin" pattern=".*">           <permissions>             <permission>hudson.model.Hudson.Read</permission>             <permission>hudson.model.Hudson.Administer</permission>             <permission>hudson.model.View.Delete</permission>             <permission>hudson.model.Computer.Create</permission>             <permission>hudson.model.Computer.Delete</permission>             <permission>hudson.model.Hudson.RunScripts</permission>             <permission>hudson.model.View.Read</permission>             <permission>hudson.model.Run.Update</permission>             <permission>hudson.model.Item.Workspace</permission>             <permission>hudson.model.Computer.Connect</permission>             <permission>hudson.model.Computer.Configure</permission>             <permission>hudson.model.Item.Cancel</permission>             <permission>hudson.model.Item.Configure</permission>             <permission>hudson.model.Item.Discover</permission>             <permission>hudson.model.Item.Create</permission>             <permission>hudson.model.View.Configure</permission>             <permission>hudson.model.Computer.Disconnect</permission>             <permission>hudson.model.Item.Delete</permission>             <permission>hudson.model.Item.Read</permission>             <permission>hudson.model.Item.Build</permission>             <permission>hudson.model.Run.Delete</permission>             <permission>hudson.model.View.Create</permission>             <permission>hudson.scm.SCM.Tag</permission>           </permissions>           <assignedSIDs>             <sid>admin</sid>           </assignedSIDs>         </role>         <role name="anonymous" pattern=".*">           <permissions>             <permission>hudson.model.Hudson.Read</permission>           </permissions>           <assignedSIDs>             <sid>anonymous</sid>           </assignedSIDs>         </role>       </roleMap>       <roleMap type="projectRoles">         <role name="Online Program" pattern="GeoQPortal|GeoQUserPortal">           <permissions>             <permission>hudson.model.Item.Read</permission>             <permission>hudson.model.Item.Build</permission>             <permission>hudson.model.Run.Delete</permission>             <permission>hudson.model.Item.Workspace</permission>             <permission>hudson.model.Run.Update</permission>             <permission>hudson.scm.SCM.Tag</permission>             <permission>hudson.model.Item.Cancel</permission>             <permission>hudson.model.Item.Discover</permission>           </permissions>           <assignedSIDs>             <sid>caox</sid>             <sid>wangwh</sid>             <sid>yuh</sid>             <sid>chenjj</sid>             <sid>lim</sid>             <sid>zhangy</sid>           </assignedSIDs>         </role>         <role name="test" pattern="Compress">           <permissions>             <permission>hudson.model.Item.Delete</permission>             <permission>hudson.model.Item.Read</permission>             <permission>hudson.model.Item.Build</permission>             <permission>hudson.model.Run.Delete</permission>             <permission>hudson.model.Item.Workspace</permission>             <permission>hudson.model.Run.Update</permission>             <permission>hudson.scm.SCM.Tag</permission>             <permission>hudson.model.Item.Cancel</permission>             <permission>hudson.model.Item.Configure</permission>             <permission>hudson.model.Item.Discover</permission>           </permissions>           <assignedSIDs>             <sid>wangwh</sid>           </assignedSIDs>         </role>       </roleMap>     </authorizationStrategy>     <securityRealm class="hudson.security.HudsonPrivateSecurityRealm">       <disableSignup>false</disableSignup>       <enableCaptcha>false</enableCaptcha>     </securityRealm>

如果发生用户不能登录的情况，可以尝试以下几种方法解决

1、方法1

· 删除用户相关的目录

· 修改$Jenkins_home/config.xml文件：<useSecurity>false</useSecurity>

· 删除authorizationStrategy、securityRealm节点

· 重新启动Jenkins

· 使用该方法将删除Jenkins的权限管理，恢复成为初始状态。

2、方法2

· 修改$Jenkins_home/config.xml文件，修改授权方式为系统自带的安全矩阵方式

authorizationStrategy节点class属性修改为hudson.security.GlobalMatrixAuthorizationStrategy

· 配置示例如下，该示例是分配给admin用户所有权限

    

<useSecurity>true</useSecurity> <authorizationStrategy class="hudson.security.GlobalMatrixAuthorizationStrategy">       <permission>hudson.model.Computer.Configure:admin</permission>       <permission>hudson.model.Computer.Connect:admin</permission>       <permission>hudson.model.Computer.Create:admin</permission>       <permission>hudson.model.Computer.Delete:admin</permission>       <permission>hudson.model.Computer.Disconnect:admin</permission>       <permission>hudson.model.Hudson.Administer:admin</permission>       <permission>hudson.model.Hudson.Read:admin</permission>       <permission>hudson.model.Hudson.Read:anonymous</permission>       <permission>hudson.model.Hudson.RunScripts:admin</permission>       <permission>hudson.model.Item.Build:admin</permission>       <permission>hudson.model.Item.Cancel:admin</permission>       <permission>hudson.model.Item.Configure:admin</permission>       <permission>hudson.model.Item.Create:admin</permission>       <permission>hudson.model.Item.Delete:admin</permission>       <permission>hudson.model.Item.Discover:admin</permission>       <permission>hudson.model.Item.Read:admin</permission>       <permission>hudson.model.Item.Workspace:admin</permission>       <permission>hudson.model.Run.Delete:admin</permission>       <permission>hudson.model.Run.Update:admin</permission>       <permission>hudson.model.View.Configure:admin</permission>       <permission>hudson.model.View.Create:admin</permission>       <permission>hudson.model.View.Delete:admin</permission>       <permission>hudson.model.View.Read:admin</permission>       <permission>hudson.scm.SCM.Tag:admin</permission>     </authorizationStrategy>     <securityRealm class="hudson.security.HudsonPrivateSecurityRealm">       <disableSignup>false</disableSignup>       <enableCaptcha>false</enableCaptcha>     </securityRealm>

 

· 重新启动Jenkins

使用该方法Jenkins将恢复为安全矩阵方式授权。