Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Guest AD user can't trigger build through API #188

Open
dejanmarich opened this issue Feb 12, 2022 · 0 comments
Open

Guest AD user can't trigger build through API #188

dejanmarich opened this issue Feb 12, 2022 · 0 comments
Labels
bug

Comments

@dejanmarich
Copy link

dejanmarich commented Feb 12, 2022 •
edited
Loading

Jenkins and plugins versions report

Environment 
Jenkins: 2.319.3
OS: Linux - 5.4.0-1067-azure
---
ace-editor:1.1
antisamy-markup-formatter:2.7
apache-httpcomponents-client-4-api:4.5.13-1.0
authentication-tokens:1.4
azure-ad:191.vfc8019068670
azure-credentials:198.vf9c2fdfde55c
azure-credentials-ext:1.0
azure-keyvault:131.v867845ef6ae9
azure-sdk:85.v4817a_b_8a_7124
bootstrap4-api:4.6.0-3
bootstrap5-api:5.1.3-4
bouncycastle-api:2.25
branch-api:2.7.0
build-name-setter:2.2.0
caffeine-api:2.9.2-29.v717aac953ff3
checks-api:1.7.2
cloudbees-folder:6.17
command-launcher:1.2
conditional-buildstep:1.4.1
config-file-provider:3.9.0
configuration-as-code:1346.ve8cfa_3473c94
credentials:1074.v60e6c29b_b_44b_
credentials-binding:1.27.1
dashboard-view:2.18
date-parameter:0.0.4
display-url-api:2.3.5
durable-task:493.v195aefbb0ff2
echarts-api:5.2.2-2
external-monitor-job:191.v363d0d1efdf8
extra-columns:1.25
file-parameters:146.v7d35212829d0
font-awesome-api:5.15.4-5
git:4.10.3
git-client:3.11.0
git-server:1.10
gitlab-api:1.0.6
gitlab-branch-source:1.5.9
handlebars:3.0.8
handy-uri-templates-2-api:2.1.8-1.0
jackson2-api:2.13.1-246.va8a9f3eaf46a
javadoc:217.v905b_86277a_2a_
javax-activation-api:1.2.0-2
javax-mail-api:1.6.2-5
jaxb:2.3.0
jdk-tool:1.0
jnr-posix-api:3.1.7-1
jquery:1.12.4-1
jquery3-api:3.6.0-2
jsch:0.1.55.2
junit:1.54
kubernetes:1.31.3
kubernetes-client-api:5.11.2-182.v0f1cf4c5904e
kubernetes-credentials:0.9.0
ldap:2.7
lockable-resources:2.14
mailer:408.vd726a_1130320
matrix-auth:3.0.1
matrix-project:1.20
maven-plugin:3.16
metrics:4.0.2.8.1
momentjs:1.1.1
nodelabelparameter:1.10.3
pam-auth:1.7
parameterized-trigger:2.43
pipeline-build-step:2.15
pipeline-graph-analysis:188.v3a01e7973f2c
pipeline-input-step:446.vf27b_0b_83500e
pipeline-milestone-step:100.v60a_03cd446e1
pipeline-model-api:1.9.3
pipeline-model-declarative-agent:1.1.1
pipeline-model-definition:1.9.3
pipeline-model-extensions:1.9.3
pipeline-rest-api:2.21
pipeline-stage-step:291.vf0a8a7aeeb50
pipeline-stage-tags-metadata:1.9.3
pipeline-stage-view:2.21
plain-credentials:1.8
plugin-util-api:2.13.0
popper-api:1.16.1-2
popper2-api:2.11.2-1
role-strategy:3.2.0
run-condition:1.5
scm-api:595.vd5a_df5eb_0e39
script-security:1131.v8b_b_5eda_c328e
snakeyaml-api:1.29.1
ssh-agent:1.24.1
ssh-credentials:1.19
ssh-slaves:1.33.0
sshd:3.1.0
strict-crumb-issuer:2.1.0
structs:308.v852b473a2b8c
throttle-concurrents:2.6
timestamper:1.17
token-macro:270.v8c2ce50dc4fc
trilead-api:1.0.13
validating-string-parameter:2.8
variant:1.4
view-job-filters:2.3
workflow-aggregator:2.6
workflow-api:1136.v7f5f1759dc16
workflow-basic-steps:2.24
workflow-cps:2648.va9433432b33c
workflow-cps-global-lib:552.vd9cc05b8a2e1
workflow-durable-task-step:1121.va_65b_d2701486
workflow-job:1145.v7f2433caa07f
workflow-multibranch:706.vd43c65dec013
workflow-scm-step:2.13
workflow-step-api:622.vb_8e7c15b_c95a_
workflow-support:813.vb_d7c3d2984a_0

What Operating System are you using (both controller, and any agents involved in the problem)?

OS: Linux - 5.4.0-1067-azure
Running jenkins on AKS

Reproduction steps

Guest AD user is added to the group with full jenkins access. I can login with the user, make changes, and run builds from the console, but when trying to run the build through API:

curl -XPOST -L \ --user [email protected]:$TOKEN \ --data parameter=XX \ https://{jenkins_url}/{job_path}/buildWithParameters?token=my-token

I get response: A problem occurred while processing the request.

Expected Results

Execute build

Actual Results

2022-02-12 22:33:46.058+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396Graph service exception Error code: Request_ResourceNotFound
2022-02-12 22:33:46.058+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396Error message: Resource '[email protected]' does not exist or one of its queried reference-property objects are not present.
2022-02-12 22:33:46.059+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396
2022-02-12 22:33:46.059+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396GET https://graph.microsoft.com/v1.0/users/[email protected]
2022-02-12 22:33:46.059+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396SdkVersion : graph-java/v3.8.0
2022-02-12 22:33:46.059+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396
2022-02-12 22:33:46.059+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396
2022-02-12 22:33:46.059+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396404 : Not Found
2022-02-12 22:33:46.060+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396[...]
2022-02-12 22:33:46.060+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396
2022-02-12 22:33:46.060+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: CoreHttpProvider[sendRequestInternal] - 396[Some information was truncated for brevity, enable debug logging for more details]
2022-02-12 22:33:46.060+0000 [id=625]	SEVERE	c.m.graph.logger.DefaultLogger#logError: Throwable detail: com.microsoft.graph.http.GraphServiceException: Error code: Request_ResourceNotFound
Error message: Resource '[email protected]' does not exist or one of its queried reference-property objects are not present.

GET https://graph.microsoft.com/v1.0/users/[email protected]
SdkVersion : graph-java/v3.8.0


404 : Not Found
[...]

[Some information was truncated for brevity, enable debug logging for more details]
2022-02-12 22:33:46.060+0000 [id=625]	WARNING	j.s.BasicHeaderApiTokenAuthenticator#authenticate2: API token matched for user [email protected] but the impersonation failed
org.springframework.security.core.userdetails.UsernameNotFoundException: Cannot find user: [email protected]
	at com.microsoft.jenkins.azuread.AzureSecurityRealm.lambda$createSecurityComponents$6(AzureSecurityRealm.java:535)
	at jenkins.security.ImpersonatingUserDetailsService2.loadUserByUsername(ImpersonatingUserDetailsService2.java:29)
	at hudson.model.User.getUserDetailsForImpersonation2(User.java:406)
	at jenkins.security.BasicHeaderApiTokenAuthenticator.authenticate2(BasicHeaderApiTokenAuthenticator.java:36)
	at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:83)
	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:97)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80)
	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:62)
	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:97)
	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:109)
	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:51)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:85)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:39)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:578)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1434)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1349)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
	at org.eclipse.jetty.server.Server.handle(Server.java:516)
	at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:388)
	at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:633)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:380)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
	at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:386)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034)
	at java.base/java.lang.Thread.run(Thread.java:829)
2022-02-12 22:33:46.060+0000 [id=625]	WARNING	h.i.i.InstallUncaughtExceptionHandler#handleException: Caught unhandled exception with ID 90a3bde5-863c-4adf-9b9b-9f61d3b0a3ff
org.springframework.security.core.userdetails.UsernameNotFoundException: Cannot find user: [email protected]
	at com.microsoft.jenkins.azuread.AzureSecurityRealm.lambda$createSecurityComponents$6(AzureSecurityRealm.java:535)
	at jenkins.security.ImpersonatingUserDetailsService2.loadUserByUsername(ImpersonatingUserDetailsService2.java:29)
	at hudson.model.User.getUserDetailsForImpersonation2(User.java:406)
	at jenkins.security.BasicHeaderApiTokenAuthenticator.authenticate2(BasicHeaderApiTokenAuthenticator.java:36)
Caused: javax.servlet.ServletException
	at jenkins.security.BasicHeaderApiTokenAuthenticator.authenticate2(BasicHeaderApiTokenAuthenticator.java:44)
	at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:83)
	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:97)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110)
	at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80)
	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:62)
	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:97)
	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:109)
	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:51)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:85)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:39)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:578)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1434)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1349)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
	at org.eclipse.jetty.server.Server.handle(Server.java:516)
	at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:388)
	at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:633)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:380)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
	at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:386)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034)
	at java.base/java.lang.Thread.run(Thread.java:829)

Anything else?

No response
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@dejanmarich