{"id":14008399,"url":"https://github.com/jenkinsci/role-strategy-plugin","last_synced_at":"2025-05-16T09:03:40.576Z","repository":{"id":37269908,"uuid":"1163713","full_name":"jenkinsci/role-strategy-plugin","owner":"jenkinsci","description":"Jenkins Role-Strategy plugin","archived":false,"fork":false,"pushed_at":"2025-05-14T18:25:15.000Z","size":2730,"stargazers_count":137,"open_issues_count":0,"forks_count":152,"subscribers_count":103,"default_branch":"master","last_synced_at":"2025-05-14T18:52:17.084Z","etag":null,"topics":["authorization","jenkins","jenkins-plugin","security"],"latest_commit_sha":null,"homepage":"https://plugins.jenkins.io/role-strategy","language":"Java","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jenkinsci.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2010-12-13T05:50:02.000Z","updated_at":"2025-05-14T18:12:25.000Z","dependencies_parsed_at":"2023-11-18T03:24:26.713Z","dependency_job_id":"876d7f38-6ef8-42cf-85c5-7a60f2592f5a","html_url":"https://github.com/jenkinsci/role-strategy-plugin","commit_stats":null,"previous_names":[],"tags_count":72,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Frole-strategy-plugin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Frole-strategy-plugin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Frole-strategy-plugin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jenkinsci%2Frole-strategy-plugin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jenkinsci","download_url":"https://codeload.github.com/jenkinsci/role-strategy-plugin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254501554,"owners_count":22081528,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["authorization","jenkins","jenkins-plugin","security"],"created_at":"2024-08-10T11:01:38.819Z","updated_at":"2025-05-16T09:03:40.557Z","avatar_url":"https://github.com/jenkinsci.png","language":"Java","funding_links":[],"categories":["Java"],"sub_categories":[],"readme":"Role Strategy plugin\n====================\n\n[![Join the chat at https://gitter.im/jenkinsci/role-strategy-plugin](https://badges.gitter.im/jenkinsci/role-strategy-plugin.svg)](https://gitter.im/jenkinsci/role-strategy-plugin?utm_source=badge\u0026utm_medium=badge\u0026utm_campaign=pr-badge\u0026utm_content=badge)\n[![Jenkins Plugin](https://img.shields.io/jenkins/plugin/v/role-strategy.svg)](https://plugins.jenkins.io/role-strategy)\n[![GitHub release](https://img.shields.io/github/release/jenkinsci/role-strategy-plugin.svg?label=changelog)](https://github.com/jenkinsci/role-strategy-plugin/releases/latest)\n[![Jenkins Plugin Installs](https://img.shields.io/jenkins/plugin/i/role-strategy.svg?color=blue)](https://plugins.jenkins.io/role-strategy)\n\n## About this plugin\n\nThe Role Strategy plugin is meant to be used from [Jenkins](https://jenkins.io) to add a new role-based mechanism to manage users' permissions. \nSupported features\n\n* Creating **global roles**, such as admin, job creator, anonymous, etc., allowing to set Overall, Agent, Job, Run, View and SCM permissions on a global basis.\n* Creating **item roles**, allowing to set item specific permissions (e.g Job, Run or Credentials) on Jobs, Pipelines and Folders.\n* Creating **agent roles**, allowing to set agent specific permissions.\n* Assigning these roles to users and user groups\n* Extending roles and permissions matching via [Macro extensions](./docs/MACROS.md)\n\n## Usage\n\n### Installing and enabling the plugin\n\nThe Role Strategy plugin can be installed from any Jenkins installation connected to the Internet using the **Plugin Manager** screen.\nActivate the Role-Based Strategy by using the standard _Manage Jenkins \u003e Configure Global Security_ screen:\n\n![Configure Security](/docs/images/configureSecurity.png)\n\nAfter the installation, the plugin can be configured using the _Manage and Assign Roles_ screen accessible from _Manage Jenkins_ .\n\n### Configuring roles\n\nYou can define roles by using the _Manages Roles_ screen. It is possible to define global, item and agent specific roles.\n\n* Global roles apply to any item in Jenkins and override *anything* you specify in the Item Roles. That is, when you give a role the\n  right `Job/Read` in the Global Roles, then this role is allowed to read all Jobs, no matter what you specify in the Item Roles.\n  Giving `Job/Create` in a global role will allow to create jobs of any name.\n* For item and agent roles you can set a regular expression pattern for matching items. The regular expression aimes at matching the full item name.\n  * For example, if you set the field to `Roger-.*`, then the role will match all jobs which name starts with `Roger-`. \n  * Patterns are case-sensitive. To perform a case-insensitive match, use `(?i)` notation: upper, `Roger-.*` vs. lower, `roger-.*` \n    vs. case-insensitive, `(?i)roger-.*`. \n  * Folders can be matched using expressions like `^foo/bar.*`. To access jobs inside a folder, the folder itself must also be accessible to the\n    user. This can be achieved with a single pattern like `(?i)folder($|/.*)` when the permissions on the folder can be the same as for the jobs.\n    If different permissions need to be configured 2 different roles need to be created, e.g. `(?i)folder` and `(?i)folder/.*`. Note that job names\n    inside folders are case-sensitive, though this is probably a bug in the folders plugin [JENKINS-67695](https://issues.jenkins.io/browse/JENKINS-67695).\n    Case sensitivity can be enabled with `(?-i)`, e.g. `(?i)folder/(?-i).*`\n  * Create permissions on item level can only reliably work when the `Naming Strategy` is set to `Role-Based strategy` in the global configuration\n    for `Restrict project naming`. You should see a warning in the administrative monitors if it is not enabled.\n    Only jobs matching the pattern can be created. When granting `Job/Create` you should also grant `Job/Configure` and `Job/Read` otherwise you will\n    be able to create new jobs but you will not be able to configure them. Global Permissions are not required.\n\n\n![Managing roles](/docs/images/manageRoles.png)\n\n#### Permission Templates\nPermission Templates simplify the administration of roles when you need to maintain many roles with identical permissions but different patterns.\nTemplates are only available for _Item Roles_. The permissions of roles based on a template can't be modified directly. Modifying the template will\nimmediately modify the linked roles after saving the changes.\n\nDeleting a template that is still in use requires confirmation. In case you still delete it, the roles stay with the given permissions but the\ncorrelation to the template is removed.\n\n### Assigning roles\n\nYou can assign roles to users and user groups using the _Assign Roles_ screen\n\n* User groups represent authorities provided by the Security Realm (e.g. Active Directory or LDAP plugin can provide groups)\n* There are also two built-in groups: `authenticated` (users who logged in) and `anonymous` (any user, including ones who have not logged in)\n* Hovering over the header row will show a tooltip with the permissions associated to the role and the pattern.\n* Hovering over a checkbox will show a tooltip with role, user/group and pattern.\n\n![Assign roles](/docs/images/assignRoles.png)\n\n### Getting roles in pipelines\nThere are 2 steps available in pipeline jobs that allow to get the roles of the user running the build.\nWhen the build was triggered by a user via the UI or the REST API, the roles of this user are returned. In case the build was triggered\nby the times or an SCM event there is no dedicated user available and the `SYSTEM` user is used. This user is considered like an admin and will have all roles.\u003cbr/\u003e\nWith the [Authorize Project](https://plugins.jenkins.io/authorize-project/) plugin, it is possible to make builds triggered by timer or an SCM event\nto run as a specific user which is then used or run as `anonymous`. For `anonymous` it means no roles are returned. The user that triggered the build will always take \nprecedence over the user that is configured via `Authorize Project`.\n\n#### currentUserGlobalRoles\nThe step `currentUserGlobalRoles` will return all global roles of the user.\n\n#### currentUserItemRoles\nThe step `currentUserItemRoles` will return the item roles of the user. By default, it returns only those roles that\nmatch the currently building pipeline. The parameter `showAllRoles` will return all item roles of the user.\n\n### Rest API\n\nThe Rest API allows to query the current roles and assignments and to do changes to them.\nPlease see the [javadoc](https://javadoc.jenkins.io/plugin/role-strategy/com/michelin/cio/hudson/plugins/rolestrategy/RoleBasedAuthorizationStrategy.html) for details and examples.\n\n### Config \u0026 Assign role by using Jenkins Script Console or Groovy Hook Script\nConfiguration management can be used via [Jenkins Script Console](https://www.jenkins.io/doc/book/managing/script-console/) or \n[Groovy Hook Scripts](https://www.jenkins.io/doc/book/managing/groovy-hook-scripts/), following example is creating an admin role \u0026 user based on plugin 3.1. \n\n```groovy\nimport com.michelin.cio.hudson.plugins.rolestrategy.AuthorizationType\nimport com.michelin.cio.hudson.plugins.rolestrategy.PermissionEntry\nimport com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy\nimport com.michelin.cio.hudson.plugins.rolestrategy.Role\nimport com.synopsys.arc.jenkins.plugins.rolestrategy.RoleType\nimport hudson.security.Permission\nimport jenkins.model.Jenkins\n\n\nJenkins jenkins = Jenkins.get()\ndef rbas = new RoleBasedAuthorizationStrategy()\n\n/* create admin role */\nSet\u003cPermission\u003e permissions = new HashSet\u003c\u003e();\npermissions.add(Jenkins.ADMINISTER)\nRole adminRole = new Role(\"admin\", permissions)\n\nglobalRoleMap = rbas.getRoleMap(RoleType.Global)\nglobalRoleMap.addRole(adminRole)\n/* assign admin role to user 'admin' */\nglobalRoleMap.assignRole(adminRole, new PermissionEntry(AuthorizationType.USER, 'admin'))\n/* assign admin role to group 'administrators' */\nglobalRoleMap.assignRole(adminRole, new PermissionEntry(AuthorizationType.GROUP, 'administrators'))\njenkins.setAuthorizationStrategy(rbas)\n\njenkins.save()\n```\n\n### Case sensitive mode\nIn previous versions of this plugin, role assignments where always matched case-sensitive, even when the security realm \nworks case-insensitive (as do most of them). As of version 685 the plugin will use the strategy given by the security realm \nto match assigned roles. If for some reason you need the old behaviour, set the property `com.michelin.cio.hudson.plugins.rolestrategy.RoleMap.FORCE_CASE_SENSITIVE`\nvia command line `jenkins -Dcom.michelin.cio.hudson.plugins.rolestrategy.RoleMap.FORCE_CASE_SENSITIVE=true -war jenkins.war`, set it via the script console or via \nan init hook script.\n\n\n\n## License\n\n[MIT License](./LICENSE.md)\n\n## More information\n\n* [Changelog](https://github.com/jenkinsci/role-strategy-plugin/releases)\n* [Macro extensions](./docs/MACROS.md)\n* [Greasemonkey Addons for Web UI](./docs/USERSCRIPTS.md)\n* [Developer documentation](./docs/DEVELOPER.md)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjenkinsci%2Frole-strategy-plugin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjenkinsci%2Frole-strategy-plugin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjenkinsci%2Frole-strategy-plugin/lists"}