Checkpoint Lab — Users, Authentication Realms, Authorization Strategies, Matrix Permissions, Folders, and Least Privilege

1. Checkpoint mission

Build and test three roles on a disposable controller: administrator (recovery-admin with Overall/Administer), builder (dev-builder with read/build on training/dev/*), and auditor (read-only on the same hierarchy).

Then intentionally add one excessive permission, prove the capability appears, and repair it without losing administrative recovery.

2. Version and resource assumptions

3. Preflight and recovery guard

1. Prove controller is local/disposable.
2. Verify recovery-admin in a separate session.
3. Record current authorization strategy/plugin versions.
4. Take a stopped-controller snapshot of the disposable JENKINS_HOME.
5. Confirm no production secret, webhook, IdP, cloud, registry, or SCM organization is connected.

docker ps --filter name=jenkins-ch04
curl -fsSI http://127.0.0.1:8080/login | grep -i '^X-Jenkins:'

docker stop jenkins-ch04
docker run --rm   -v jenkins_ch04_home:/source:ro   -v "$PWD":/backup   alpine:3.22   sh -lc 'cd /source && tar -czf /backup/jenkins-ch04-pre-matrix.tgz .'
docker start jenkins-ch04

4. Write predictions before changing the matrix

Also predict state: a successful builder action creates a new build number/cause but does not modify job configuration; a denied auditor build creates no new build number.

5. Implement the baseline policy

Use Jenkins’ internal user database for this disposable checkpoint and Project-based Matrix Authorization Strategy. Keep anonymous empty. Preserve recovery-admin globally. Give non-admin users only the global read prerequisite and folder-scoped job grants they need.

6. Prove one allowed and one denied action per role

Use separate sessions. For build tests capture full item name, build number, URL, cause, and agent/node. For denials capture non-sensitive status/message and confirm protected state did not change.

7. Introduce one controlled over-broad permission

Grant Job/Configure to dev-builder on training/dev. Predict that the user can now modify executable job configuration. Save, sign in as dev-builder, and verify Configure becomes authorized.

Make only one harmless description change. Do not add a secret, external endpoint, privileged agent, or destructive build step. Record that configuration changed even though Overall/Administer remained absent.

8. Repair the causal entry without losing recovery

As recovery-admin, remove only Job/Configure from dev-builder. Preserve Read and Build. Retest: builder still reads/builds; builder can no longer configure; auditor stays read-only; recovery-admin still administers.

This is causal repair, not “reset everything.”

9. Required evidence packet

Redact cookies, CSRF crumbs, API tokens, password hashes, encrypted credentials, and controller secret keys.

10. Cleanup and rollback

docker stop jenkins-ch04
docker rm jenkins-ch04

docker volume inspect jenkins_ch04_home
docker volume rm jenkins_ch04_home

docker image rm jenkins-ch04:2.568.3

11. Production bridge

You have demonstrated the core operating discipline for Jenkins access control: attributable identities, rare/recoverable administration, scoped item permissions, positive and negative tests, Configure as code-execution authority, and credential administration separated from job visibility.

Chapter 05 moves into Freestyle jobs, build steps, post-build actions, parameters, and triggers. The access-control model from this chapter becomes the guardrail around those job operations.

Knowledge check

Official references and version notes

• Jenkins Access Control — authentication via a security realm and authorization via an authorization strategy are separate decisions.
• Jenkins Permissions — current definitions for Overall, Job, Run, View, Credentials, and Pipeline-related permissions.
• Managing Security — realms, authorization modes, matrix security, and controller-wide security settings.
• Matrix Authorization Strategy Plugin — global/project matrices, inheritance modes, and item-configuration caveats.
• Folders Plugin — folder-based item organization used by the scoped-access examples.
• Jenkins Credentials security guidance — credential scope and access minimization.
• Controller Isolation — why users who influence build code must not run routine builds on the built-in node.