Authorization strategies (Matrix, role-based) in Jenkins - Commands & Configuration

Introduction

Jenkins controls who can do what using authorization strategies. These strategies help keep your projects safe by deciding who can build, configure, or manage jobs.

When you want to let some team members only run builds but not change settings

When you need to give admins full control but restrict others to view-only access

When you want to assign specific permissions to users or groups based on their roles

When you want to manage permissions easily for many users in a growing team

When you want to prevent accidental changes by limiting who can configure jobs

Commands

This command applies a Matrix-based authorization strategy using a Groovy script through Jenkins CLI. It sets specific permissions for users.

Terminal

java -jar jenkins-cli.jar -s http://localhost:8080/ groovy = < configure-matrix-auth.groovy

Expected Output

No output (command runs silently)

→

-s - Specifies the Jenkins server URL

This command applies a Role-Based authorization strategy using a Groovy script through Jenkins CLI. It defines roles and assigns users to them.

Terminal

java -jar jenkins-cli.jar -s http://localhost:8080/ groovy = < configure-role-based-auth.groovy

Expected Output

No output (command runs silently)

→

-s - Specifies the Jenkins server URL

This command checks the current user identity in Jenkins CLI to confirm permissions are applied correctly.

Terminal

java -jar jenkins-cli.jar -s http://localhost:8080/ who-am-i

Expected Output

Authenticated as: admin

Authorities: [authenticated, admin]

→

-s - Specifies the Jenkins server URL

Key Concept

If you remember nothing else from this pattern, remember: authorization strategies control who can do what in Jenkins to keep your projects safe and organized.

Common Mistakes

Not assigning any permissions to users after enabling Matrix or Role-Based strategy

This locks out users including admins, preventing any actions in Jenkins

Always assign at least one admin user full permissions before applying the strategy

Mixing Matrix and Role-Based strategies at the same time

Jenkins only allows one authorization strategy active, so this causes conflicts

Choose one strategy that fits your needs and configure only that one

Summary

Use Matrix strategy to assign specific permissions directly to users or groups.

Use Role-Based strategy to create roles with permissions and assign users to these roles.

Apply changes via Jenkins CLI with Groovy scripts to automate authorization setup.

Practice

1. What is the main difference between Jenkins' Matrix Authorization Strategy and Role-Based Authorization Strategy?

easy

A. Matrix assigns permissions directly to users; Role-Based assigns permissions to roles.

B. Matrix uses roles; Role-Based assigns permissions directly to users.

C. Matrix is only for admins; Role-Based is for all users.

D. Matrix strategy is deprecated; Role-Based is the only supported method.

Solution

1. Step 1: Understand Matrix Strategy

   Matrix strategy assigns specific permissions directly to individual users or groups.

2. Step 2: Understand Role-Based Strategy

   Role-Based strategy assigns users to roles, and roles have predefined permissions.

3. Final Answer:

   Matrix assigns permissions directly to users; Role-Based assigns permissions to roles. -> Option A

4. Quick Check:

   Matrix = direct user permissions, Role-Based = roles with permissions [OK]

Hint: Matrix = user permissions, Role-Based = roles permissions [OK]

Common Mistakes:

• Confusing roles with users in Matrix strategy
• Thinking Matrix is deprecated
• Assuming Role-Based assigns permissions directly to users

2. Which of the following is the correct way to enable Matrix Authorization Strategy in Jenkins configuration?

easy

A. Go to Manage Jenkins > Configure Global Security > Select 'Project-based Matrix Authorization Strategy'.

B. Go to Manage Jenkins > Configure System > Select 'Role-based security' and assign roles.

C. Go to Manage Jenkins > Configure Global Security > Select 'Matrix-based security' and assign permissions.

D. Go to Manage Jenkins > Configure Global Security > Select 'LDAP Authorization Strategy'.

Solution

1. Step 1: Locate Security Settings

   Matrix Authorization Strategy is enabled under Manage Jenkins > Configure Global Security.

2. Step 2: Select Correct Option

   Select 'Matrix-based security' to assign permissions directly to users or groups.

3. Final Answer:

   Go to Manage Jenkins > Configure Global Security > Select 'Matrix-based security' and assign permissions. -> Option C

4. Quick Check:

   Matrix security enabled via Configure Global Security > Matrix-based security [OK]

Hint: Matrix security is under Configure Global Security, not Configure System [OK]

Common Mistakes:

• Choosing 'Role-based security' instead of 'Matrix-based security'
• Selecting 'Project-based Matrix Authorization Strategy' for global settings
• Confusing LDAP with Matrix strategy

3. Given this Role-Based Authorization Strategy setup:
Role: Developer - Permissions: Read, Build
User: alice assigned to Developer role
User: bob assigned to no roles
What will be the result if alice and bob try to build a job?

medium

A. Both alice and bob can build the job.

B. Only bob can build the job; alice cannot.

C. Neither alice nor bob can build the job.

D. Only alice can build the job; bob cannot.

Solution

1. Step 1: Check alice's permissions

   alice is assigned the Developer role, which has Build permission, so she can build jobs.

2. Step 2: Check bob's permissions

   bob has no roles assigned, so he has no Build permission and cannot build jobs.

3. Final Answer:

   Only alice can build the job; bob cannot. -> Option D

4. Quick Check:

   Role permissions control build access; alice has role, bob does not [OK]

Hint: Only users with roles having Build permission can build jobs [OK]

Common Mistakes:

• Assuming users without roles have default build access
• Confusing read permission with build permission
• Thinking roles assign permissions to users automatically without assignment

4. You configured Matrix Authorization Strategy but users report they cannot access the Jenkins dashboard. What is the most likely cause?

medium

A. You did not restart Jenkins after configuration.

B. You forgot to grant 'Overall Read' permission to the users.

C. You enabled Role-Based Authorization Strategy instead of Matrix.

D. You assigned too many permissions to the users.

Solution

1. Step 1: Understand Matrix permissions

   In Matrix strategy, users must have 'Overall Read' permission to see the Jenkins dashboard.

2. Step 2: Identify missing permission

   If users cannot access the dashboard, likely 'Overall Read' permission was not granted.

3. Final Answer:

   You forgot to grant 'Overall Read' permission to the users. -> Option B

4. Quick Check:

   Missing 'Overall Read' blocks dashboard access [OK]

Hint: Always grant 'Overall Read' to users for dashboard access [OK]

Common Mistakes:

• Assuming too many permissions cause access issues
• Confusing Role-Based and Matrix strategies
• Thinking Jenkins restart is required after permission changes

5. You want to create a Jenkins setup where users can only view jobs but only members of the 'QA' role can build and configure jobs. Which strategy and configuration best fits this requirement?

hard

A. Use Role-Based Authorization Strategy; assign 'QA' role with Build and Configure permissions, assign other users to a role with only Read permission.

B. Use Matrix Authorization Strategy; assign Build and Configure permissions to all users except QA.

C. Use Role-Based Authorization Strategy; assign all users to 'Admin' role with full permissions.

D. Use Matrix Authorization Strategy; assign all permissions to anonymous users.

Solution

1. Step 1: Identify requirement for role-based control

   Users need different permission sets based on roles, so Role-Based Authorization Strategy fits best.

2. Step 2: Assign roles and permissions

   Create a 'QA' role with Build and Configure permissions; assign other users a role with only Read permission.

3. Final Answer:

   Use Role-Based Authorization Strategy; assign 'QA' role with Build and Configure permissions, assign other users to a role with only Read permission. -> Option A

4. Quick Check:

   Role-Based strategy allows role-specific permissions as required [OK]

Hint: Role-Based strategy is best for different permission sets by role [OK]

Common Mistakes:

• Assigning build permissions to all users in Matrix strategy
• Giving all users admin rights
• Using Matrix strategy when role separation is needed