Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use ACL.as #2084

Merged
merged 10 commits into from
Aug 22, 2020
Merged

Use ACL.as #2084

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
b79fa79
Use ACL.as
jglick Aug 4, 2020
8238dc4
Merge branch 'master' into ACL.as
olamy Aug 4, 2020
2f1434b
Some tests were using PrincipalAcegiUserToken, and calling SecurityCo…
jglick Aug 6, 2020
6d1f427
A couple more places to use ACL.as
jglick Aug 6, 2020
fc00c6d
More
jglick Aug 6, 2020
77c024c
Merge branch 'master' of github.com:jenkinsci/blueocean-plugin into A…
jglick Aug 21, 2020
c6f0662
Revert "More"
jglick Aug 21, 2020
3433455
Revert "Some tests were using PrincipalAcegiUserToken, and calling Se…
jglick Aug 21, 2020
ced7010
A more modest goal: getting rid of PrincipalAcegiUserToken
jglick Aug 21, 2020
103dc11
Merge branch 'master' into ACL.as
olamy Aug 21, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 2 additions & 10 deletions ...nkins/blueocean/blueocean_bitbucket_pipeline/server/BitbucketServerEndpointContainer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@
import com.google.common.collect.Iterators;
import com.google.common.collect.Lists;
import hudson.security.ACL;
import hudson.security.ACLContext;
import io.jenkins.blueocean.blueocean_bitbucket_pipeline.Messages;
import io.jenkins.blueocean.commons.ErrorMessage;
import io.jenkins.blueocean.commons.ServiceException;
Expand All @@ -14,8 +15,6 @@
import io.jenkins.blueocean.rest.impl.pipeline.scm.ScmServerEndpoint;
import io.jenkins.blueocean.rest.impl.pipeline.scm.ScmServerEndpointContainer;
import net.sf.json.JSONObject;
import org.acegisecurity.context.SecurityContext;
import org.acegisecurity.context.SecurityContextHolder;
import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.lang.StringUtils;
import org.slf4j.Logger;
Expand Down Expand Up @@ -80,16 +79,9 @@ public ScmServerEndpoint create(JSONObject request) {
throw new ServiceException.BadRequestException(new ErrorMessage(400, "Failed to create Bitbucket server endpoint").addAll(errors));
}
final com.cloudbees.jenkins.plugins.bitbucket.endpoints.BitbucketServerEndpoint endpoint = new com.cloudbees.jenkins.plugins.bitbucket.endpoints.BitbucketServerEndpoint(name, url, false, null);
SecurityContext old=null;
try {
try (ACLContext ctx = ACL.as(ACL.SYSTEM)) {
// We need to escalate privilege to add user defined endpoint to
old = ACL.impersonate(ACL.SYSTEM);
endpointConfiguration.addEndpoint(endpoint);
}finally {
//reset back to original privilege level
if(old != null){
SecurityContextHolder.setContext(old);
}
}
return new BitbucketServerEndpoint(endpoint, this);
}
Expand Down
15 changes: 2 additions & 13 deletions ...e/src/main/java/io/jenkins/blueocean/blueocean_github_pipeline/GithubServerContainer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,16 +10,14 @@
import com.google.common.collect.Ordering;
import com.google.common.hash.Hashing;
import hudson.security.ACL;
import hudson.security.ACLContext;
import io.jenkins.blueocean.commons.ErrorMessage;
import io.jenkins.blueocean.commons.ServiceException;
import io.jenkins.blueocean.rest.hal.Link;
import io.jenkins.blueocean.rest.impl.pipeline.scm.ScmServerEndpoint;
import io.jenkins.blueocean.rest.impl.pipeline.scm.ScmServerEndpointContainer;
import net.sf.json.JSONObject;
import org.acegisecurity.context.SecurityContext;
import org.acegisecurity.context.SecurityContextHolder;
import org.apache.commons.collections.ComparatorUtils;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.StringUtils;
import org.jenkinsci.plugins.github_branch_source.Endpoint;
import org.jenkinsci.plugins.github_branch_source.GitHubConfiguration;
Expand All @@ -29,9 +27,7 @@
import javax.annotation.Nullable;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.net.HttpURLConnection;
import java.nio.charset.Charset;
import java.util.Comparator;
import java.util.HashMap;
import java.util.Iterator;
Expand Down Expand Up @@ -120,10 +116,8 @@ public class GithubServerContainer extends ScmServerEndpointContainer {
}

if (errors.isEmpty()) {
SecurityContext old = null;
try {
try (ACLContext ctx = ACL.as(ACL.SYSTEM)) {
// We need to escalate privilege to add user defined endpoint to
old = ACL.impersonate(ACL.SYSTEM);
GitHubConfiguration config = GitHubConfiguration.get();
String sanitizedUrl = discardQueryString(url);
Endpoint endpoint = new Endpoint(sanitizedUrl, name);
Expand All @@ -132,11 +126,6 @@ public class GithubServerContainer extends ScmServerEndpointContainer {
} else {
return new GithubServer(endpoint, getLink());
}
}finally {
//reset back to original privilege level
if(old != null){
SecurityContextHolder.setContext(old);
}
}
}
ErrorMessage message = new ErrorMessage(400, "Failed to create GitHub server");
Expand Down
19 changes: 4 additions & 15 deletions blueocean-jwt/src/main/java/io/jenkins/blueocean/auth/jwt/impl/JwtAuthenticationFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,11 @@

import hudson.Extension;
import hudson.init.Initializer;
import hudson.security.ACL;
import hudson.security.ACLContext;
import hudson.util.PluginServletFilter;
import io.jenkins.blueocean.auth.jwt.JwtTokenVerifier;
import org.acegisecurity.Authentication;
import org.acegisecurity.context.SecurityContext;
import org.acegisecurity.context.SecurityContextHolder;
import org.acegisecurity.context.SecurityContextImpl;
import org.apache.commons.lang.StringUtils;
import org.kohsuke.stapler.Stapler;

Expand Down Expand Up @@ -75,19 +74,9 @@ public void doFilter(ServletRequest req, ServletResponse rsp, FilterChain chain)

// run the rest of the request with the new identity
// create a new context and set it to holder to not clobber existing context
SecurityContext sc = new SecurityContextImpl();
sc.setAuthentication(token);
SecurityContext previous = SecurityContextHolder.getContext();
SecurityContextHolder.setContext(sc);
request.setAttribute(JWT_TOKEN_VALIDATED,true);
try {
try (ACLContext ctx = ACL.as(token)) {
request.setAttribute(JWT_TOKEN_VALIDATED, true);
chain.doFilter(req,rsp);
} finally {
if(previous != null){
SecurityContextHolder.setContext(previous);
}else {
SecurityContextHolder.clearContext();
}
}
}

Expand Down
4 changes: 2 additions & 2 deletions ...line-api-impl/src/test/java/io/jenkins/blueocean/rest/impl/pipeline/PipelineBaseTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,8 @@
import hudson.tasks.Mailer;
import io.jenkins.blueocean.commons.JsonConverter;
import jenkins.model.Jenkins;
import org.acegisecurity.adapters.PrincipalAcegiUserToken;
import org.acegisecurity.context.SecurityContextHolder;
import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.acegisecurity.userdetails.UserDetails;
import org.jenkinsci.plugins.workflow.actions.ThreadNameAction;
import org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition;
Expand Down Expand Up @@ -638,7 +638,7 @@ protected User login(String userId, String fullName, String email) throws IOExce

UserDetails d = Jenkins.getInstance().getSecurityRealm().loadUserByUsername(bob.getId());

SecurityContextHolder.getContext().setAuthentication(new PrincipalAcegiUserToken(bob.getId(),bob.getId(),bob.getId(), d.getAuthorities(), bob.getId()));
SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(bob.getId(), bob.getId(), d.getAuthorities()));
return bob;
}
protected User login() throws IOException {
Expand Down
5 changes: 2 additions & 3 deletions blueocean-rest-impl/src/test/java/io/jenkins/blueocean/service/embedded/BaseTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,13 +13,12 @@
import hudson.model.Run;
import hudson.model.User;
import hudson.security.csrf.CrumbIssuer;
import hudson.security.csrf.DefaultCrumbIssuer;
import hudson.tasks.Mailer;
import io.jenkins.blueocean.commons.JsonConverter;
import jenkins.model.Jenkins;
import net.sf.json.JSONObject;
import org.acegisecurity.adapters.PrincipalAcegiUserToken;
import org.acegisecurity.context.SecurityContextHolder;
import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.acegisecurity.userdetails.UserDetails;
import org.junit.Assert;
import org.junit.Before;
Expand Down Expand Up @@ -529,7 +528,7 @@ protected User login(String userId, String fullName, String email) throws IOExce

UserDetails d = Jenkins.getInstance().getSecurityRealm().loadUserByUsername(bob.getId());

SecurityContextHolder.getContext().setAuthentication(new PrincipalAcegiUserToken(bob.getId(),bob.getId(),bob.getId(), d.getAuthorities(), bob.getId()));
SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(bob.getId(), bob.getId(), d.getAuthorities()));
return bob;
}
protected User login() throws IOException {
Expand Down
4 changes: 2 additions & 2 deletions blueocean-rest-impl/src/test/java/io/jenkins/blueocean/service/embedded/ProfileApiTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@
import io.jenkins.blueocean.rest.factory.organization.OrganizationFactory;
import io.jenkins.blueocean.service.embedded.rest.UserImpl;
import jenkins.model.Jenkins;
import org.acegisecurity.adapters.PrincipalAcegiUserToken;
import org.acegisecurity.context.SecurityContextHolder;
import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;
import org.acegisecurity.userdetails.UserDetails;
import org.junit.Assert;
import org.junit.Ignore;
Expand Down Expand Up @@ -391,7 +391,7 @@ public void testPermissionOfOtherUser() throws IOException {

UserDetails d = Jenkins.getInstance().getSecurityRealm().loadUserByUsername(bob.getId());

SecurityContextHolder.getContext().setAuthentication(new PrincipalAcegiUserToken(bob.getId(),bob.getId(),bob.getId(), d.getAuthorities(), bob.getId()));
SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(bob.getId(), bob.getId(), d.getAuthorities()));

Assert.assertNull(new UserImpl(Iterables.getFirst(OrganizationFactory.getInstance().list(), null), alice).getPermission());
}
Expand Down