allow github oauth tokens to be used to access jenkins api#37
Merged
Conversation
Member
|
Thank you for a pull request! Please check this document for how the Jenkins project handles pull requests |
Member
|
I'd like a few people to code review this pull request before it gets merged. |
Member
Author
|
@samrocketman +1. |
Member
|
Can you give examples to places where a user/password is needed? It's not clear to me why this is desired. It would probably help others in their review as well. |
Member
Author
|
@samrocketman interacting with the api - with this you can use oauth from github (alternative is to go to jenkins and create per user tokens as needed - I believe) but with this you can just delegate all auth to github. |
Member
|
LGTM insofar as I get it. I'm not so familiar with the Jenkins security API though ( I suppose it's difficult to write a test for this? |
Member
Author
|
Yeah - I didn't see scaffolding to mock/simulate the GitHub api for auth in place.
|
Member
Author
|
bump |
Member
|
Don't worry, I see it. I'm leaving it open for people to get a chance to code review it. |
Member
|
I'll merge this the next chance I get. |
Member
|
I see no difference in the behavior of this plugin after merging and testing this. I still don't get what this does that the current implementation doesn't do. |
Member
|
Actually, I think I understand better what you meant by API. You mean the Jenkins API, correct? |
Member
|
I can't seem to get this to work. I've tried... Using the GitHub application token doesn't work at all. When I use my GitHub username and password I get the following exception. Please note: I generated a token with only |
Member
|
Still having a hard time testing this. Here's basically the steps I've done on Ubuntu 14.04.2 LTS. I automatically provisioned Jenkins using cd ~/git/github/
git clone git@github.com:samrocketman/jenkins-bootstrap-jervis.git
cd jenkins-bootstrap-jervis
./jervis_bootstrap.shNow that Jenkins is up and running I built and installed the github-oauth plugin. #downloaded Oracle Java 1.6
export JAVA_HOME="/home/sam/src/java/jdk1.6.0_45/"
export PATH="${JAVA_HOME}/bin:${PATH}"
#download Apache maven 3.2.5
export PATH="/home/sam/src/maven/apache-maven-3.2.5/bin:${PATH}"
#clone the latest master of github-oauth plugin
cd ~/git/github/
git clone git@github.com:jenkinsci/github-oauth-plugin.git
cd github-oauth-plugin
#merge pull request 37
git ls-remote origin | grep 37
git fetch origin refs/pull/37/head
git merge --no-ff FETCH_HEAD
#build the plugin
mvn test && mvn package
#Install the newly built plugin.
cd ~/git/github/jenkins-bootstrap-jervis
./scripts/provision_jenkins.sh install-plugins ~/git/github/github-oauth-plugin/target/github-oauth.hpi
#Restart jenkins
./scripts/provision_jenkins.sh restartI visited In the global project-based matrix authorization strategy settings I configured the following users.
I then executed. curl -X POST http://localhost:8080/job/_jervis_generator/build --user "samrocketman:myGitHubPassword" --data-urlencode json='{"parameter": [{"name":"project", "value":"samrocketman/jervis"}]}'I can't seem to get the plugin to be able to interact with the Jenkins API using GitHub credentials. Can you please test this the way I did it. If you can replicate it then perhaps fix it? |
Member
|
I even gave |
Member
|
I finally figured it out.
curl -X POST http://localhost:8080/job/_jervis_generator/build --user "samrocketman:myGitHubPersonalAccessToken" --data-urlencode json='{"parameter": [{"name":"project", "value":"samrocketman/jervis"}]}' |
Member
|
In the future, I would really appreciate if you could give me more information with how I can test a change you're making. It would make my life easier. In any case, this is a really neat change. Great job! |
Member
Author
|
Thanks @samrocketman. Sorry my fault. 1) I have used github 2FA for a long time so it never occurred to me to try the normal password (ie I have used personal access tokens since forever) - my mistake. 2) I was lazing around this weekend feeling the effects of a cold so didn't see your trials. I should have put an example in of what I mean to save you working it out in the end! Sorry about that - but thanks again for merging. It is a pretty neat change (not sure how people did api access otherwise, perhaps they don't like this...), and you get to use github to audit and control all access. |
Member
|
I really like the change. To access the API one would typically generate their own Jenkins tokens or make use of the SSH private/public key pair to authenticate with Jenkins API. This has given a path forward for being a fix for other issues in JIRA: JENKINS-17539, JENKINS-21458, JENKINS-27688, JENKINS-27045. Thanks again for this neat contribution. |
Member
Author
|
NP. FYI this has been in use in production for some time at http://ambiata.com/ so it works quite well (it goes as far as even using github auth to have ssh slaves self register (jnlp wasn't quite right in this case) with the master - so very convenient. Wiki is down but I gather you just did a release? |
Member
|
Correct, I did a release earlier today. You can download it at Jenkins maven. |
Member
Author
|
thanks @samrocketman |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
as user/password for places where that is needed.