Jenkins 基于角色的授权策略插件不同用户的行为不一致
当前状态：我已经实施了基于项目的角色策略（也称为项目角色），并设置了适当的项目文件夹级别正则表达式等。我已经验证了正则表达式和其他权限对于大多数登录用户来说都可以正常工作，除了我遇到的以下情况。
- 插件版本：3.2
- Jenkins 版本：2.263.4
- Jenkins 身份验证提供程序：LDAP 连接到 Active Directory
- 示例正则表达式：对于项目角色 dev =
^ABC\-DEF\/DEV\/.*
<强>问题：某些用户仅在使用基于项目角色的授权插件时遇到问题，他们无法看到运行构建或作业配置的选项。虽然相同的配置适用于具有相同权限的其他几个用户。
示例： 用户 - adm-XXXX 和 adm-YYYY 以及其他一些以 adm 前缀开头的用户 - 无法获取以下角色配置和运行基于上述正则表达式构建作业。
而用户 - adm-zzzz 和其他人可以使用相同的权限矩阵获得相同的角色。
这个问题非常不一致，因为有些天它会工作，甚至当我在另一个 Jenkins 实例中测试时相同的配置也适用于用户 - adm-XXXX 所以我不知道如何调试为什么它不能始终如一地为少数用户工作。我可以理解，如果这是一个配置问题，它不应该适用于具有相同角色的所有用户。
由于插件代码中实际上有几个记录器，因此是否有任何关于启用一些额外调试来解决此问题的提示。
感谢任何一位知识渊博的人在这里提供的帮助。
Current State: I have implemented project based roles strategy (also called the item roles) and have the appropriate project folder level regex etc set up. And I have verified the regexes and other permissions work fine for most logged in users, except the below scenarios I am running into.
- Plugin Version: 3.2
- Jenkins Version: 2.263.4
- Jenkins Authentication Provider: LDAP Connecting to Active Directory
- Example regex(es): for project role dev =
^ABC\-DEF\/DEV\/.*
Issue: Certain users are only having issues while going through the project role based authorization plugin where they are not able to see the option to run builds or job configurations. While the same configurations work for a couple of other user who have the same permissions.
Example:
Users - adm-XXXX and adm-YYYY and a few more all starting with the prefix of adm- are not able to get the roles for the configure and run builds on the jobs based on the above regex.
While Users - adm-zzzz and others are able to get the same roles using the same permission matrix.
The issue is very inconsistent as some days it would work, and even the same configurations when I tested in another Jenkins instance it worked for the user - adm-XXXX so I am at a loss on how to debug why it does not work for a few users consistently. I can understand if it is a configuration issue it should not work for all users having the same role.
Are there any tips on enabling some extra debug to troubleshoot this since there are literally a couple of loggers in the code of the plugin.
Appreciate the help here from any one knowledegable.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我有同样的问题，将 LDAP/AD 用户关联到本地全局角色或启用构建和配置权限的项目/项目角色不会在项目本身中启用此权限。构建和配置选项不可用。
我解决这个问题的唯一方法是将用户添加到 AD 组中，并将 AD 组与具有所需权限的角色相关联。
对 AD 组角色启用与本地角色完全相同的权限，从而在项目中启用构建和配置选项。
我不确定这是否是一个错误，一个无法混合/匹配本地和 AD 角色的 AD 集成问题，或者我缺少一些选项，或者是否有人设法解决了这个异常问题 - 但这个工作似乎克服了这个问题。
I have same issue, where associating an LDAP/AD user to a local global role or item/project role with build and configure permissions enabled does not enable this permission in the project itself. The option to build and configure is not available.
The only way I got around this was to add the users into AD groups and associating the AD Group to a role with required permissions.
Enabling the exact same permissions on the AD group role that I had on the local role, enabled the build and configure option in the projects.
I am not sure if this is a bug, an AD integration issue that you cannot mix/match local and AD roles or I am missing some option or if anyone has managed to get around this anomoly - but this workaournd seems to overcome this.