Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ambiguous security permissions #3217

Closed
richardlau opened this issue Mar 10, 2023 · 1 comment
Closed

Ambiguous security permissions #3217

richardlau opened this issue Mar 10, 2023 · 1 comment

Comments

@richardlau
Copy link
Member

richardlau commented Mar 10, 2023

Follow on from #3176 (comment):

One of the things we need to now address is that version 3 of the Matrix Authorization Strategy plugin now requires permissions to be declared as for groups or users otherwise they are marked as ambiguous. A list of jobs that need to be updated can be found at https://ci.nodejs.org/administrativeMonitor/org.jenkinsci.plugins.matrixauth.AmbiguityMonitor/.

Fortunately the remediation is fairly simple but we need to do it for every job listed. As an example, for
node-test-pull-request, go into the "Configure" tab for the job and you'll see this:
image
The rows in orange with a ⚠️ symbol are the ambiguous ones. On the far right of the row, after the red cross, are two icons -- one for mitigating the entry as a user, and the other for mitigating as a group. For almost all of these I expect we'd be mitigating as a group (these should reflect GitHub groups as we are using GitHub Authentication).

@targos
Copy link
Member

targos commented Apr 9, 2023

All jobs updated.

@targos targos closed this as completed Apr 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants