Authorization strategies (Matrix, role-based) in Jenkins - Step-by-Step Execution

Process Flow - Authorization strategies (Matrix, role-based)

Start: User Access Request

↓

Check Authorization Strategy

↓

Matrix Strategy

↓

Check User Permissions

↓

Allow or Deny Access

↓

Access Granted or Denied

When a user requests access, Jenkins checks which authorization strategy is active. It either checks detailed permissions per user (Matrix) or checks user roles (Role-Based) to allow or deny access.

Execution Sample

Jenkins

matrixAuthorizationStrategy {
  permission('hudson.model.Item.Build', 'alice')
  permission('hudson.model.Item.Read', 'bob')
}
roleBasedAuthorizationStrategy {
  role('admin', ['alice'])
  role('developer', ['bob'])
}

Defines permissions for users using matrix and roles for role-based authorization.

Process Table

Step	User	Authorization Strategy	Check	Result	Access Outcome
1	alice	Matrix	Check if 'Build' permission granted	Yes	Access Allowed
2	bob	Matrix	Check if 'Build' permission granted	No	Access Denied
3	bob	Matrix	Check if 'Read' permission granted	Yes	Access Allowed
4	alice	Role-Based	Check if user in 'admin' role	Yes	Access Allowed
5	bob	Role-Based	Check if user in 'admin' role	No	Access Denied
6	bob	Role-Based	Check if user in 'developer' role	Yes	Access Allowed
7	charlie	Matrix	Check permissions	No	Access Denied
8	charlie	Role-Based	Check roles	No	Access Denied

💡 Access is granted only if the user has the required permission (Matrix) or belongs to the required role (Role-Based).

Status Tracker

Variable	Start	After Step 1	After Step 3	After Step 6	Final
alice_permissions	{}	{Build}	{Build}	{Build}	{Build}
bob_permissions	{}	{}	{Read}	{Read}	{Read}
alice_roles	{}	{admin}	{admin}	{admin}	{admin}
bob_roles	{}	{}	{}	{developer}	{developer}
charlie_permissions	{}	{}	{}	{}	{}
charlie_roles	{}	{}	{}	{}	{}

Key Moments - 3 Insights

Why does bob get denied access when checking 'Build' permission in Matrix strategy?

Because bob only has 'Read' permission, not 'Build'. The execution_table row 2 shows the check fails and access is denied.

How does Role-Based strategy simplify permission management?

It groups users into roles with predefined permissions. For example, alice is in 'admin' role (row 4), so she gets access without checking individual permissions.

What happens if a user is not assigned any permissions or roles?

They are denied access by default, as shown for charlie in rows 7 and 8.

Visual Quiz - 3 Questions

Look at the execution table, what permission does alice have in the Matrix strategy at step 1?

A 'Read'

B 'Build'

C 'Admin'

D No permissions

💡 Hint

Check the 'Check' and 'Result' columns in row 1 of the execution_table.

At which step does bob get access denied in Role-Based strategy?

A Step 5

B Step 6

C Step 2

D Step 3

💡 Hint

Look at the 'Access Outcome' column for bob in Role-Based rows.

If charlie was added to the 'developer' role, which step's outcome would change?

A Step 1

B Step 7

C Step 8

D Step 4

💡 Hint

Check the Role-Based strategy rows for charlie in the execution_table.

Concept Snapshot

Authorization strategies in Jenkins:
- Matrix: Assign specific permissions per user.
- Role-Based: Assign users to roles with grouped permissions.
- Access allowed if user has required permission or role.
- Deny by default if no permission or role.
- Choose strategy based on complexity and team size.

Full Transcript

This visual execution shows how Jenkins handles user access with two authorization strategies: Matrix and Role-Based. When a user requests access, Jenkins checks which strategy is active. For Matrix, it looks at specific permissions assigned to the user, like 'Build' or 'Read'. For Role-Based, it checks if the user belongs to a role like 'admin' or 'developer'. The execution table traces checks for users alice, bob, and charlie, showing when access is allowed or denied. Variables track permissions and roles assigned. Key moments clarify why some users get denied and how roles simplify management. The quiz tests understanding by referencing specific steps. The snapshot summarizes key points for quick recall.

Practice

1. What is the main difference between Jenkins' Matrix Authorization Strategy and Role-Based Authorization Strategy?

easy

A. Matrix assigns permissions directly to users; Role-Based assigns permissions to roles.

B. Matrix uses roles; Role-Based assigns permissions directly to users.

C. Matrix is only for admins; Role-Based is for all users.

D. Matrix strategy is deprecated; Role-Based is the only supported method.

Solution

1. Step 1: Understand Matrix Strategy

   Matrix strategy assigns specific permissions directly to individual users or groups.

2. Step 2: Understand Role-Based Strategy

   Role-Based strategy assigns users to roles, and roles have predefined permissions.

3. Final Answer:

   Matrix assigns permissions directly to users; Role-Based assigns permissions to roles. -> Option A

4. Quick Check:

   Matrix = direct user permissions, Role-Based = roles with permissions [OK]

Hint: Matrix = user permissions, Role-Based = roles permissions [OK]

Common Mistakes:

• Confusing roles with users in Matrix strategy
• Thinking Matrix is deprecated
• Assuming Role-Based assigns permissions directly to users

2. Which of the following is the correct way to enable Matrix Authorization Strategy in Jenkins configuration?

easy

A. Go to Manage Jenkins > Configure Global Security > Select 'Project-based Matrix Authorization Strategy'.

B. Go to Manage Jenkins > Configure System > Select 'Role-based security' and assign roles.

C. Go to Manage Jenkins > Configure Global Security > Select 'Matrix-based security' and assign permissions.

D. Go to Manage Jenkins > Configure Global Security > Select 'LDAP Authorization Strategy'.

Solution

1. Step 1: Locate Security Settings

   Matrix Authorization Strategy is enabled under Manage Jenkins > Configure Global Security.

2. Step 2: Select Correct Option

   Select 'Matrix-based security' to assign permissions directly to users or groups.

3. Final Answer:

   Go to Manage Jenkins > Configure Global Security > Select 'Matrix-based security' and assign permissions. -> Option C

4. Quick Check:

   Matrix security enabled via Configure Global Security > Matrix-based security [OK]

Hint: Matrix security is under Configure Global Security, not Configure System [OK]

Common Mistakes:

• Choosing 'Role-based security' instead of 'Matrix-based security'
• Selecting 'Project-based Matrix Authorization Strategy' for global settings
• Confusing LDAP with Matrix strategy

3. Given this Role-Based Authorization Strategy setup:
Role: Developer - Permissions: Read, Build
User: alice assigned to Developer role
User: bob assigned to no roles
What will be the result if alice and bob try to build a job?

medium

A. Both alice and bob can build the job.

B. Only bob can build the job; alice cannot.

C. Neither alice nor bob can build the job.

D. Only alice can build the job; bob cannot.

Solution

1. Step 1: Check alice's permissions

   alice is assigned the Developer role, which has Build permission, so she can build jobs.

2. Step 2: Check bob's permissions

   bob has no roles assigned, so he has no Build permission and cannot build jobs.

3. Final Answer:

   Only alice can build the job; bob cannot. -> Option D

4. Quick Check:

   Role permissions control build access; alice has role, bob does not [OK]

Hint: Only users with roles having Build permission can build jobs [OK]

Common Mistakes:

• Assuming users without roles have default build access
• Confusing read permission with build permission
• Thinking roles assign permissions to users automatically without assignment

4. You configured Matrix Authorization Strategy but users report they cannot access the Jenkins dashboard. What is the most likely cause?

medium

A. You did not restart Jenkins after configuration.

B. You forgot to grant 'Overall Read' permission to the users.

C. You enabled Role-Based Authorization Strategy instead of Matrix.

D. You assigned too many permissions to the users.

Solution

1. Step 1: Understand Matrix permissions

   In Matrix strategy, users must have 'Overall Read' permission to see the Jenkins dashboard.

2. Step 2: Identify missing permission

   If users cannot access the dashboard, likely 'Overall Read' permission was not granted.

3. Final Answer:

   You forgot to grant 'Overall Read' permission to the users. -> Option B

4. Quick Check:

   Missing 'Overall Read' blocks dashboard access [OK]

Hint: Always grant 'Overall Read' to users for dashboard access [OK]

Common Mistakes:

• Assuming too many permissions cause access issues
• Confusing Role-Based and Matrix strategies
• Thinking Jenkins restart is required after permission changes

5. You want to create a Jenkins setup where users can only view jobs but only members of the 'QA' role can build and configure jobs. Which strategy and configuration best fits this requirement?

hard

A. Use Role-Based Authorization Strategy; assign 'QA' role with Build and Configure permissions, assign other users to a role with only Read permission.

B. Use Matrix Authorization Strategy; assign Build and Configure permissions to all users except QA.

C. Use Role-Based Authorization Strategy; assign all users to 'Admin' role with full permissions.

D. Use Matrix Authorization Strategy; assign all permissions to anonymous users.

Solution

1. Step 1: Identify requirement for role-based control

   Users need different permission sets based on roles, so Role-Based Authorization Strategy fits best.

2. Step 2: Assign roles and permissions

   Create a 'QA' role with Build and Configure permissions; assign other users a role with only Read permission.

3. Final Answer:

   Use Role-Based Authorization Strategy; assign 'QA' role with Build and Configure permissions, assign other users to a role with only Read permission. -> Option A

4. Quick Check:

   Role-Based strategy allows role-specific permissions as required [OK]

Hint: Role-Based strategy is best for different permission sets by role [OK]

Common Mistakes:

• Assigning build permissions to all users in Matrix strategy
• Giving all users admin rights
• Using Matrix strategy when role separation is needed