Authorization strategies (Matrix, role-based) in Jenkins - Mini Project: Build & Apply

Authorization Strategies in Jenkins: Matrix and Role-Based

📖 Scenario: You are setting up a Jenkins server for a small team. You want to control who can do what in Jenkins by using authorization strategies. This helps keep your projects safe and organized.

🎯 Goal: Learn how to configure Jenkins authorization strategies: first using the Matrix-based security, then adding role-based access control. You will create user permissions and roles step-by-step.

📋 What You'll Learn

Access to Jenkins web interface

Basic knowledge of Jenkins UI navigation

Understanding of users and permissions concepts

💡 Why This Matters

🌍 Real World

Controlling who can do what in Jenkins keeps your projects safe and organized, especially in teams.

💼 Career

Understanding Jenkins authorization strategies is essential for DevOps engineers and system administrators managing CI/CD pipelines.

1

Set up Matrix-based Security

In Jenkins, enable Matrix-based security under Manage Jenkins > Configure Global Security. Create a user called developer and give this user Overall Read and Job Build permissions only. Write the configuration snippet that shows the developer user with these permissions in the matrix.

Jenkins

# Add the matrix security configuration snippet for user 'developer' with 'Overall Read' and 'Job Build' permissions
# Your code here

Hint

Look for the matrix block and add permission lines for the developer user.

2

Add Role-Based Authorization Plugin Setup

Add a variable called roleStrategy that represents enabling the Role-Based Authorization Strategy plugin in Jenkins. This variable should be set to enabled to indicate the plugin is active.

Jenkins

authorizationStrategy {
  matrix {
    permission('Overall.Read', 'developer')
    permission('Job.Build', 'developer')
  }
}

# Set roleStrategy variable to 'enabled'
# Your code here

Hint

Just create a variable named roleStrategy and assign it the string 'enabled'.

3

Define Roles and Assign Permissions

Create a dictionary called roles with two roles: admin and viewer. The admin role should have permissions Overall/Administer and Job/Configure. The viewer role should have only Overall/Read. Then assign the user developer to the viewer role.

Jenkins

authorizationStrategy {
  matrix {
    permission('Overall.Read', 'developer')
    permission('Job.Build', 'developer')
  }
}
roleStrategy = 'enabled'

# Create roles dictionary and assign 'developer' user to 'viewer' role
# Your code here

Hint

Use a dictionary named roles with keys 'admin' and 'viewer'. Then create user_roles dictionary to assign 'developer' to 'viewer'.

4

Display User Roles and Permissions

Write a print statement that outputs the string User developer has viewer role with permissions: ['Overall/Read'] using the user_roles and roles dictionaries.

Jenkins

authorizationStrategy {
  matrix {
    permission('Overall.Read', 'developer')
    permission('Job.Build', 'developer')
  }
}
roleStrategy = 'enabled'

roles = {
  'admin': ['Overall.Administer', 'Job.Configure'],
  'viewer': ['Overall.Read']
}
user_roles = {'developer': 'viewer'}

# Print user role and permissions
# Your code here

Hint

Use an f-string to print the role and permissions for user developer.

Practice

1. What is the main difference between Jenkins' Matrix Authorization Strategy and Role-Based Authorization Strategy?

easy

A. Matrix assigns permissions directly to users; Role-Based assigns permissions to roles.

B. Matrix uses roles; Role-Based assigns permissions directly to users.

C. Matrix is only for admins; Role-Based is for all users.

D. Matrix strategy is deprecated; Role-Based is the only supported method.

Solution

1. Step 1: Understand Matrix Strategy

   Matrix strategy assigns specific permissions directly to individual users or groups.

2. Step 2: Understand Role-Based Strategy

   Role-Based strategy assigns users to roles, and roles have predefined permissions.

3. Final Answer:

   Matrix assigns permissions directly to users; Role-Based assigns permissions to roles. -> Option A

4. Quick Check:

   Matrix = direct user permissions, Role-Based = roles with permissions [OK]

Hint: Matrix = user permissions, Role-Based = roles permissions [OK]

Common Mistakes:

• Confusing roles with users in Matrix strategy
• Thinking Matrix is deprecated
• Assuming Role-Based assigns permissions directly to users

2. Which of the following is the correct way to enable Matrix Authorization Strategy in Jenkins configuration?

easy

A. Go to Manage Jenkins > Configure Global Security > Select 'Project-based Matrix Authorization Strategy'.

B. Go to Manage Jenkins > Configure System > Select 'Role-based security' and assign roles.

C. Go to Manage Jenkins > Configure Global Security > Select 'Matrix-based security' and assign permissions.

D. Go to Manage Jenkins > Configure Global Security > Select 'LDAP Authorization Strategy'.

Solution

1. Step 1: Locate Security Settings

   Matrix Authorization Strategy is enabled under Manage Jenkins > Configure Global Security.

2. Step 2: Select Correct Option

   Select 'Matrix-based security' to assign permissions directly to users or groups.

3. Final Answer:

   Go to Manage Jenkins > Configure Global Security > Select 'Matrix-based security' and assign permissions. -> Option C

4. Quick Check:

   Matrix security enabled via Configure Global Security > Matrix-based security [OK]

Hint: Matrix security is under Configure Global Security, not Configure System [OK]

Common Mistakes:

• Choosing 'Role-based security' instead of 'Matrix-based security'
• Selecting 'Project-based Matrix Authorization Strategy' for global settings
• Confusing LDAP with Matrix strategy

3. Given this Role-Based Authorization Strategy setup:
Role: Developer - Permissions: Read, Build
User: alice assigned to Developer role
User: bob assigned to no roles
What will be the result if alice and bob try to build a job?

medium

A. Both alice and bob can build the job.

B. Only bob can build the job; alice cannot.

C. Neither alice nor bob can build the job.

D. Only alice can build the job; bob cannot.

Solution

1. Step 1: Check alice's permissions

   alice is assigned the Developer role, which has Build permission, so she can build jobs.

2. Step 2: Check bob's permissions

   bob has no roles assigned, so he has no Build permission and cannot build jobs.

3. Final Answer:

   Only alice can build the job; bob cannot. -> Option D

4. Quick Check:

   Role permissions control build access; alice has role, bob does not [OK]

Hint: Only users with roles having Build permission can build jobs [OK]

Common Mistakes:

• Assuming users without roles have default build access
• Confusing read permission with build permission
• Thinking roles assign permissions to users automatically without assignment

4. You configured Matrix Authorization Strategy but users report they cannot access the Jenkins dashboard. What is the most likely cause?

medium

A. You did not restart Jenkins after configuration.

B. You forgot to grant 'Overall Read' permission to the users.

C. You enabled Role-Based Authorization Strategy instead of Matrix.

D. You assigned too many permissions to the users.

Solution

1. Step 1: Understand Matrix permissions

   In Matrix strategy, users must have 'Overall Read' permission to see the Jenkins dashboard.

2. Step 2: Identify missing permission

   If users cannot access the dashboard, likely 'Overall Read' permission was not granted.

3. Final Answer:

   You forgot to grant 'Overall Read' permission to the users. -> Option B

4. Quick Check:

   Missing 'Overall Read' blocks dashboard access [OK]

Hint: Always grant 'Overall Read' to users for dashboard access [OK]

Common Mistakes:

• Assuming too many permissions cause access issues
• Confusing Role-Based and Matrix strategies
• Thinking Jenkins restart is required after permission changes

5. You want to create a Jenkins setup where users can only view jobs but only members of the 'QA' role can build and configure jobs. Which strategy and configuration best fits this requirement?

hard

A. Use Role-Based Authorization Strategy; assign 'QA' role with Build and Configure permissions, assign other users to a role with only Read permission.

B. Use Matrix Authorization Strategy; assign Build and Configure permissions to all users except QA.

C. Use Role-Based Authorization Strategy; assign all users to 'Admin' role with full permissions.

D. Use Matrix Authorization Strategy; assign all permissions to anonymous users.

Solution

1. Step 1: Identify requirement for role-based control

   Users need different permission sets based on roles, so Role-Based Authorization Strategy fits best.

2. Step 2: Assign roles and permissions

   Create a 'QA' role with Build and Configure permissions; assign other users a role with only Read permission.

3. Final Answer:

   Use Role-Based Authorization Strategy; assign 'QA' role with Build and Configure permissions, assign other users to a role with only Read permission. -> Option A

4. Quick Check:

   Role-Based strategy allows role-specific permissions as required [OK]

Hint: Role-Based strategy is best for different permission sets by role [OK]

Common Mistakes:

• Assigning build permissions to all users in Matrix strategy
• Giving all users admin rights
• Using Matrix strategy when role separation is needed