Checkpoint Lab — SSO, LDAP, OIDC/SAML Plugins, External Identity, RBAC Patterns, and Enterprise Access Governance

1. Scenario

You operate a disposable controller named jenkins-lab-30. Three enterprise groups must be represented:

You will then remove Bob from jnk-builders, prove the build right disappears, simulate the identity provider becoming unavailable, recover through the offline break-glass configuration, and finally restore the external/simulated realm.

2. Recorded lab assumptions

Date: 2026-09-17
Jenkins: 2.568.3 LTS
Java: 21
Mock Security Realm: 134.v31b_1cc496b_43 (LAB ONLY)
Matrix Authorization Strategy: 3.3
Optional comparison plugins:
  LDAP: 825.v2fca_37dd5b_cb_
  OIDC: 4.718.ve731df6ca_88a_
  SAML: 4.623.v7875d61cd9f5
  Role Strategy: 898.vc050ed2424ca_
Built-in executors: 0
Target folder: identity-lab/team-a
Target job: identity-lab/team-a/smoke
Anonymous permissions: none

3. Prediction gate — write these down before execution

1. After enabling the synthetic external-style realm and authorization mapping, Alice will read but not build; Bob will build but not configure; Carol will administer the disposable controller.
2. After Bob loses jnk-builders and starts a fresh session, the same job build action will be denied while viewer access remains.
3. During the simulated IdP outage, new external authentication will fail but anonymous access will remain disabled.
4. Applying the offline recovery configuration will change the security realm/controller configuration state, not job build history or artifact state; the temporary recovery admin will regain controlled administration.

4. Setup and preflight

Use a disposable controller or clone. Create identity-lab/team-a/smoke as a harmless Pipeline/Freestyle job that only emits synthetic text on a non-controller agent. Capture controller/core/Java/plugin inventory and a configuration snapshot before the realm change.

pipeline {
  agent { label 'ch30-lab' }
  stages {
    stage('Smoke') {
      steps {
        echo 'synthetic identity-governance lab only'
      }
    }
  }
}

If you do not have a separate agent, keep the job defined but do not enable a controller executor merely to run it. Authorization tests can still verify Job/Build permission without violating controller-isolation policy.

5. Execute the three-group mapping

Configure the synthetic realm identities, then map the three groups with Matrix Authorization. Keep the mapping minimal and explicit. Capture the authorization table before testing.

6. Verify independently

For each user, start a fresh session and test the exact actions above. Record HTTP/UI result and, for Bob’s allowed build, capture job full name, build number, build cause/user identity, queue item if visible, agent label/workspace, source/Jenkinsfile revision if SCM-backed, and console log.

At least one negative test must produce an explicit permission denial. A checkpoint with only successful tests does not prove least privilege.

7. Deprovision Bob

Remove Bob from jnk-builders in the simulated external source. Preserve the “before” membership record. Then:

1. End the old browser session or otherwise use a clean session according to the realm contract.
2. Authenticate Bob again.
3. Prove Bob can still read if he remains in jnk-viewers.
4. Prove Job/Build is now denied for identity-lab/team-a/smoke.
5. If Bob has a Jenkins API token in the lab, revoke it and capture only token metadata/revocation evidence—never its value.

8. IdP outage drill

Trigger the Mock Security Realm outage simulation or use a configuration-only equivalent. Verify that an unauthenticated request does not gain anonymous access. Preserve the login failure and provider/realm evidence.

Then follow the offline recovery procedure: use trusted controller configuration access to apply the prebuilt local-realm recovery configuration, authenticate as the temporary recovery administrator, inspect the controller, and record the exact realm change. Do not alter job source, build history, artifacts or agent trust just to prove access.

After the simulated provider recovers, restore the external-style realm configuration, verify Carol can administer again, verify Alice/Bob policies, and rotate/remove the temporary recovery credential.

9. Required evidence packet

10. Verification checklist

• Authentication and authorization results are recorded separately.
• No broad group receives Overall/Administer.
• Anonymous access remains disabled throughout the outage drill.
• Built-in node remains at zero executors.
• No real client secret, LDAP password, SAML key, API token or enterprise identifier is stored in the lab evidence.
• Bob’s removed group actually changes observed Jenkins capability after a fresh session.
• Break-glass recovery is normally inactive, audited, reversible and followed by credential rotation.
• Realm/plugin/core versions are documented so the exercise is reproducible.

11. Cleanup and rollback

1. Restore the controller to the pre-lab configuration or delete the disposable controller.
2. Remove Mock Security Realm from any environment that is not explicitly a disposable test instance.
3. Delete synthetic users/tokens and temporary recovery credentials.
4. Retain only sanitized evidence and configuration diffs—never secret material.
5. If an optional external IdP simulator was used, delete its lab application/client and fake users.

12. What Chapter 30 adds to the production Jenkins model

You now have an identity-control model that distinguishes realm authentication from Jenkins authorization, treats external groups as policy inputs rather than privileges, handles browser sessions and Jenkins API tokens as separate lifecycle state, and includes a tested IdP-outage recovery path. Chapter 31 builds on this governance model to protect the software supply chain itself: SBOMs, signatures, provenance, trusted agents and dependency controls.

Knowledge check

Answer before revealing the explanation.

Official references and version notes

• Jenkins LTS changelog — chapter baseline: Jenkins 2.568.3 LTS; labs use Java 21.
• Securing Jenkins — security realm versus authorization strategy, least privilege, controller isolation and access-control fundamentals.
• LDAP plugin — version 825.v2fca_37dd5b_cb_ (requires Jenkins 2.504.3); current release includes fixes beyond earlier LDAP referral/SSRF advisories.
• OpenID Connect Authentication plugin — version 4.718.ve731df6ca_88a_ (requires Jenkins 2.539); issuer/audience/group-claim behavior is provider configuration, not Jenkins authorization by itself.
• SAML plugin — version 4.623.v7875d61cd9f5 (requires Jenkins 2.504.3).
• Matrix Authorization Strategy — version 3.3 (requires Jenkins 2.528.3); supports granular global/project authorization.
• Role-based Authorization Strategy — version 898.vc050ed2424ca_ (requires Jenkins 2.559); supports global/item/agent roles and group assignments.
• Mock Security Realm — version 134.v31b_1cc496b_43; intentionally insecure and suitable only for disposable testing/demonstration.