Jenkins - Only Allow Certain Users to Execute Certain Projects

Question

On my Jenkins instance I have 2 environments created: 1. DEV and 2. PROD. For authentication I am using Matrix-based security against an Active Directory server (AD groups). This works great for global permissions. But I need to lock down the PROD projects. How can I restrict who can create/execute/modify PROD projects in Jenkins? All PROD project names begin w/ either "PROD -" or "PROD_".

Initially, I thought I could use Groovy to implement an authorization pre-check whenever a PROD project was triggered. But I'm not sure if this is feasible.

Right now, I'm looking into possibly using one of the following plugins:

https://wiki.jenkins.io/display/JENKINS/Job+Restrictions+Plugin https://wiki.jenkins.io/display/JENKINS/Role+Strategy+Plugin

Has anyone had success in restricting certain Jenkins project to certain users (preferably incorporating Active Directory groups)?

Answer 1

Similarly to the “Matrix-based security” authentication option, there is a “Project-based Matrix Authorization Strategy” authentication option that will allow you to set different permissions in the individual project settings. Set it to “Project-based Matrix Authorization Strategy” under Manage Jenkins -> Configure Global Security.

Then, go to your project and in the configuration, check the Enable project-based security to set it in the individual project.