diff --git a/demos/global-matrix-auth/README.md b/demos/global-matrix-auth/README.md deleted file mode 100644 index 93868c48dc..0000000000 --- a/demos/global-matrix-auth/README.md +++ /dev/null @@ -1,62 +0,0 @@ -# matrix-auth-plugin - -Requires `matrix-auth` >= 3.0 - -There are a couple of built-in authorizations to consider. - -- **anonymous** - anyone who has not logged in. -- **authenticated** - anyone who has logged in. - -## sample-configuration (global matrix) - -```yaml -jenkins: - authorizationStrategy: - globalMatrix: - permissions: - - "USER:Overall/Read:anonymous" - - "GROUP:Overall/Administer:authenticated" - - "USER:Overall/Administer:admin" -``` -Permissions must be defined **per line**, meaning each line must grant permission to only a single role, and only a single user or group of users. - -## sample-configuration (project based matrix) - -```yaml -jenkins: - authorizationStrategy: - projectMatrix: - permissions: - - "View/Delete:authenticated" - - "View/Read:authenticated" - - "View/Configure:authenticated" - - "View/Create:authenticated" - - "Job/Read:authenticated" - - "Job/Build:authenticated" - - "Job/Configure:authenticated" - - "Job/Create:authenticated" - - "Job/Delete:authenticated" - - "Job/Discover:authenticated" - - "Job/Move:authenticated" - - "Job/Workspace:authenticated" - - "Job/Cancel:authenticated" - - "Run/Delete:authenticated" - - "Run/Replay:authenticated" - - "Run/Update:authenticated" - - "SCM/Tag:authenticated" - - "Overall/Read:anonymous" - - "Overall/Administer:authenticated" -``` - -Some permissions depends on actual plugin-usage. -For Example: `Release/*:authenticated` is only available if you _use_ the Release plugin in one of your jobs. - -## GitHub Authorization - -https://plugins.jenkins.io/github-oauth/ - -You can configure authorization based on GitHub users, organizations, or teams. - -- **username** - specific GitHub username. -- **organization** - every user that belongs to a specific GitHub organization. -- **organization*team** - specific GitHub team of a GitHub organization. diff --git a/demos/matrix-auth/README.md b/demos/matrix-auth/README.md index e8ead276d4..9d846e0c49 100644 --- a/demos/matrix-auth/README.md +++ b/demos/matrix-auth/README.md @@ -1,21 +1,80 @@ -# Configure Matrix Authorization Strategy +# matrix-auth-plugin -Basic configuration of the [Matrix Authorization Strategy plugin](https://plugins.jenkins.io/matrix-auth) +Configuration of the [Matrix Authorization Strategy plugin](https://plugins.jenkins.io/matrix-auth) -## sample configuration +There are a couple of built-in authorizations to consider. + +- **anonymous** - anyone who has not logged in. +- **authenticated** - anyone who has logged in. + +## sample-configuration (global matrix) ```yaml jenkins: - securityRealm: - local: - allowsSignup: false - users: - - id: test - password: test - authorizationStrategy: globalMatrix: - permissions: - - "Overall/Read:anonymous" - - "Overall/Administer:authenticated" + entries: + - user: + name: "admin" + permissions: + - "Overall/Administer" + - user: + name: "anonymous" + permissions: + - "Overall/Read" + - "Job/Read" + - group: + name: "authenticated" + permissions: + - "Overall/Read" + - "Job/Build" + - "Job/Create" ``` + + +## sample-configuration (project based matrix) + +```yaml +jenkins: + authorizationStrategy: + projectMatrix: + entries: + - group: + name: "authenticated" + permissions: + - "View/Delete" + - "View/Read" + - "View/Configure" + - "View/Create" + - "Job/Read" + - "Job/Build" + - "Job/Configure" + - "Job/Create" + - "Job/Delete" + - "Job/Discover" + - "Job/Move" + - "Job/Workspace" + - "Job/Cancel" + - "Run/Delete" + - "Run/Replay" + - "Run/Update" + - "SCM/Tag" + - "Overall/Administer" + - user: + name: "anonymous" + permissions: + - "Overall/Read" +``` + +Some permissions depends on actual plugin-usage. +For Example: `Release/*:authenticated` is only available if you _use_ the Release plugin in one of your jobs. + +## GitHub Authorization + +https://plugins.jenkins.io/github-oauth/ + +You can configure authorization based on GitHub users, organizations, or teams. + +- **username** - specific GitHub username. +- **organization** - every user that belongs to a specific GitHub organization. +- **organization*team** - specific GitHub team of a GitHub organization. diff --git a/integrations/pom.xml b/integrations/pom.xml index 718cc178f4..a4c03af10d 100644 --- a/integrations/pom.xml +++ b/integrations/pom.xml @@ -14,7 +14,7 @@ true 2.516 - ${jenkins.baseline}.1 + ${jenkins.baseline}.3 diff --git a/integrations/src/test/java/io/jenkins/plugins/casc/GlobalMatrixAuthorizationTest.java b/integrations/src/test/java/io/jenkins/plugins/casc/GlobalMatrixAuthorizationTest.java deleted file mode 100644 index a55f2a5466..0000000000 --- a/integrations/src/test/java/io/jenkins/plugins/casc/GlobalMatrixAuthorizationTest.java +++ /dev/null @@ -1,41 +0,0 @@ -package io.jenkins.plugins.casc; - -import static org.junit.Assert.assertEquals; - -import hudson.security.GlobalMatrixAuthorizationStrategy; -import io.jenkins.plugins.casc.misc.ConfiguredWithReadme; -import io.jenkins.plugins.casc.misc.JenkinsConfiguredWithReadmeRule; -import java.util.ArrayList; -import java.util.List; -import jenkins.model.Jenkins; -import org.junit.Rule; -import org.junit.Test; - -/** - * @author Mads Nielsen - * @since 1.0 - */ -public class GlobalMatrixAuthorizationTest { - - @Rule - public JenkinsConfiguredWithReadmeRule j = new JenkinsConfiguredWithReadmeRule(); - - @Test - @ConfiguredWithReadme("matrix-auth/README.md") - public void checkCorrectlyConfiguredPermissions() { - assertEquals( - "The configured instance must use the Global Matrix Authentication Strategy", - GlobalMatrixAuthorizationStrategy.class, - Jenkins.get().getAuthorizationStrategy().getClass()); - GlobalMatrixAuthorizationStrategy gms = - (GlobalMatrixAuthorizationStrategy) Jenkins.get().getAuthorizationStrategy(); - - List adminPermission = - new ArrayList<>(gms.getGrantedPermissions().get(Jenkins.ADMINISTER)); - assertEquals("authenticated", adminPermission.get(0)); - - List readPermission = - new ArrayList<>(gms.getGrantedPermissions().get(Jenkins.READ)); - assertEquals("anonymous", readPermission.get(0)); - } -} diff --git a/integrations/src/test/java/io/jenkins/plugins/casc/MatrixAuthorizationTest.java b/integrations/src/test/java/io/jenkins/plugins/casc/MatrixAuthorizationTest.java new file mode 100644 index 0000000000..151d499a54 --- /dev/null +++ b/integrations/src/test/java/io/jenkins/plugins/casc/MatrixAuthorizationTest.java @@ -0,0 +1,60 @@ +package io.jenkins.plugins.casc; + +import static org.junit.Assert.assertEquals; + +import hudson.model.Job; +import hudson.security.GlobalMatrixAuthorizationStrategy; +import hudson.security.ProjectMatrixAuthorizationStrategy; +import io.jenkins.plugins.casc.misc.ConfiguredWithReadme; +import io.jenkins.plugins.casc.misc.JenkinsConfiguredWithReadmeRule; +import java.util.Set; +import jenkins.model.Jenkins; +import org.jenkinsci.plugins.matrixauth.PermissionEntry; +import org.junit.Rule; +import org.junit.Test; +import org.junit.jupiter.api.Assertions; + +/** + * @author Mads Nielsen + * @since 1.0 + */ +public class MatrixAuthorizationTest { + + @Rule + public JenkinsConfiguredWithReadmeRule j = new JenkinsConfiguredWithReadmeRule(); + + @Test + @ConfiguredWithReadme("matrix-auth/README.md#0") + public void checkGlobalCorrectlyConfiguredPermissions() { + assertEquals( + "The configured instance must use the Global Matrix Authentication Strategy", + GlobalMatrixAuthorizationStrategy.class, + Jenkins.get().getAuthorizationStrategy().getClass()); + GlobalMatrixAuthorizationStrategy gms = + (GlobalMatrixAuthorizationStrategy) Jenkins.get().getAuthorizationStrategy(); + + Set adminPermission = gms.getGrantedPermissionEntries().get(Job.BUILD); + assertEquals("authenticated", adminPermission.iterator().next().getSid()); + + Set readPermission = gms.getGrantedPermissionEntries().get(Job.READ); + assertEquals("anonymous", readPermission.iterator().next().getSid()); + } + + @Test + @ConfiguredWithReadme("matrix-auth/README.md#1") + public void checkProjectCorrectlyConfiguredPermissions() { + Assertions.assertEquals( + ProjectMatrixAuthorizationStrategy.class, + Jenkins.get().getAuthorizationStrategy().getClass(), + "The configured instance must use the Global Matrix Authentication Strategy"); + ProjectMatrixAuthorizationStrategy gms = + (ProjectMatrixAuthorizationStrategy) Jenkins.get().getAuthorizationStrategy(); + + Set adminPermission = gms.getGrantedPermissionEntries().get(Jenkins.ADMINISTER); + Assertions.assertEquals( + "authenticated", adminPermission.iterator().next().getSid()); + + Set readPermission = gms.getGrantedPermissionEntries().get(Jenkins.READ); + Assertions.assertEquals("anonymous", readPermission.iterator().next().getSid()); + } +} diff --git a/integrations/src/test/java/io/jenkins/plugins/casc/ProjectMatrixAuthorizationTest.java b/integrations/src/test/java/io/jenkins/plugins/casc/ProjectMatrixAuthorizationTest.java deleted file mode 100644 index 6c652ec392..0000000000 --- a/integrations/src/test/java/io/jenkins/plugins/casc/ProjectMatrixAuthorizationTest.java +++ /dev/null @@ -1,38 +0,0 @@ -package io.jenkins.plugins.casc; - -import static org.junit.jupiter.api.Assertions.assertEquals; - -import hudson.security.ProjectMatrixAuthorizationStrategy; -import io.jenkins.plugins.casc.misc.ConfiguredWithCode; -import io.jenkins.plugins.casc.misc.JenkinsConfiguredWithCodeRule; -import io.jenkins.plugins.casc.misc.junit.jupiter.WithJenkinsConfiguredWithCode; -import java.util.ArrayList; -import java.util.List; -import jenkins.model.Jenkins; -import org.junit.jupiter.api.Test; - -/** - * Created by mads on 2/22/18. - */ -@WithJenkinsConfiguredWithCode -class ProjectMatrixAuthorizationTest { - - @Test - @ConfiguredWithCode("ProjectMatrixStrategy.yml") - void checkCorrectlyConfiguredPermissions(JenkinsConfiguredWithCodeRule j) { - assertEquals( - ProjectMatrixAuthorizationStrategy.class, - Jenkins.get().getAuthorizationStrategy().getClass(), - "The configured instance must use the Global Matrix Authentication Strategy"); - ProjectMatrixAuthorizationStrategy gms = - (ProjectMatrixAuthorizationStrategy) Jenkins.get().getAuthorizationStrategy(); - - List adminPermission = - new ArrayList<>(gms.getGrantedPermissions().get(Jenkins.ADMINISTER)); - assertEquals("authenticated", adminPermission.get(0)); - - List readPermission = - new ArrayList<>(gms.getGrantedPermissions().get(Jenkins.READ)); - assertEquals("anonymous", readPermission.get(0)); - } -}