Add telemetry for security-related settings (jenkinsci#8440)

* Add telemetry for security-related settings

* Actually include component information

* FindBugs, also TcpSlaveAgentListener can be null

---------

Co-authored-by: Daniel Beck <[email protected]>
(cherry picked from commit 95373a9)

core/src/main/java/jenkins/telemetry/impl/SecurityConfiguration.java

@@ -0,0 +1,79 @@
+/*
+ * The MIT License
+ *
+ * Copyright (c) 2023, CloudBees, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package jenkins.telemetry.impl;
+
+import edu.umd.cs.findbugs.annotations.NonNull;
+import hudson.Extension;
+import hudson.ExtensionList;
+import hudson.TcpSlaveAgentListener;
+import hudson.security.csrf.CrumbIssuer;
+import java.time.LocalDate;
+import jenkins.model.Jenkins;
+import jenkins.security.apitoken.ApiTokenPropertyConfiguration;
+import jenkins.telemetry.Telemetry;
+import net.sf.json.JSONObject;
+
+@Extension
+public class SecurityConfiguration extends Telemetry {
+    @NonNull
+    @Override
+    public String getDisplayName() {
+        return "Basic information about security-related settings";
+    }
+
+    @NonNull
+    @Override
+    public LocalDate getStart() {
+        return LocalDate.of(2023, 8, 1);
+    }
+
+    @NonNull
+    @Override
+    public LocalDate getEnd() {
+        return LocalDate.of(2023, 12, 1);
+    }
+
+    @Override
+    public JSONObject createContent() {
+        final Jenkins j = Jenkins.get();
+        final JSONObject o = new JSONObject();
+        o.put("components", buildComponentInformation());
+
+        o.put("authorizationStrategy", j.getAuthorizationStrategy().getClass().getName());
+        o.put("securityRealm", j.getSecurityRealm().getClass().getName());
+        final CrumbIssuer crumbIssuer = j.getCrumbIssuer();
+        o.put("crumbIssuer", crumbIssuer == null ? null : crumbIssuer.getClass().getName());
+        o.put("markupFormatter", j.getMarkupFormatter().getClass().getName());
+        final TcpSlaveAgentListener tcpSlaveAgentListener = j.getTcpSlaveAgentListener();
+        o.put("inboundAgentListener", tcpSlaveAgentListener == null ? null : tcpSlaveAgentListener.configuredPort != -1);
+
+        final ApiTokenPropertyConfiguration apiTokenPropertyConfiguration = ExtensionList.lookupSingleton(ApiTokenPropertyConfiguration.class);
+        o.put("apiTokenCreationOfLegacyTokenEnabled", apiTokenPropertyConfiguration.isCreationOfLegacyTokenEnabled());
+        o.put("apiTokenTokenGenerationOnCreationEnabled", apiTokenPropertyConfiguration.isTokenGenerationOnCreationEnabled());
+        o.put("apiTokenUsageStatisticsEnabled", apiTokenPropertyConfiguration.isUsageStatisticsEnabled());
+
+        return o;
+    }
+}

core/src/main/resources/jenkins/telemetry/impl/SecurityConfiguration/description.jelly

@@ -0,0 +1,17 @@
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core">
+    This trial collects basic information about security settings:
+    <ul>
+        <li>The type of the currently configured security realm, e.g., <code>hudson.security.HudsonPrivateSecurityRealm</code></li>
+        <li>The type of the currently configured authorization strategy, e.g., <code>hudson.security.ProjectMatrixAuthorizationStrategy</code></li>
+        <li>The type of the currently configured crumb issuer, e.g., <code>hudson.security.csrf.DefaultCrumbIssuer</code></li>
+        <li>The type of the currently configured markup formatter, e.g., <code>hudson.markup.RawHtmlMarkupFormatter</code></li>
+        <li>Whether the TCP port for inbound agents is enabled (fixed or random) or disabled</li>
+        <li>Whether the API token option labeled <em>Generate a legacy API token for each newly created user (Not recommended)</em> is enabled or disabled</li>
+        <li>Whether the API token option labeled <em>Allow users to manually create a legacy API token (Not recommended)</em> is enabled or disabled</li>
+        <li>Whether the API token option labeled <em>Enable API Token usage statistics</em> is enabled or disabled</li>
+    </ul>
+
+    Additionally this trial collects the list of installed plugins, their version, and the version of Jenkins.
+    This data will be used to understand the popularity of the various implementations for each of these features.
+</j:jelly>