[JENKINS-10601] Matrix Project Authentication does not correctly override global permissions

[jenkins-infra-bot]

I configured global authentication to allow "authenticated" users to have all permissions.

Then, for a specific project, I configured several users to have all permissions, and "authenticated" users to have no permissions.

I expected that these project-level settings for authenticated users would trump global permissions.

Instead, it had no effect. all authenticated users could still perform all operations on this project.

Now, if in global permissions, I removed administer, build, and configure permissions for authenticated users, then the project level permissions worked as expected.

However, there's a serious downside here: by removing those permissions for authenticated users at the global level, I then have to add them for every project, which surely is not the expected behavior.

I'd expect that if authenticated users have all permissions, then all projects by default would inherit those permissions. However, the act of checking off "Enable Project Based Security" on any project should signal to Jenkins that Global permissions do not apply to this project, and that the only permissions that should apply are the ones configured for that project.

---

Originally reported by marcesher, imported from: Matrix Project Authentication does not correctly override global permissions

• status: Resolved
• priority: Major
• component(s): core
• resolution: Duplicate
• resolved: 2014-05-21T00:54:36+00:00
• votes: 3
• watchers: 4
• imported: 2025-11-24

Raw content of original issue

I configured global authentication to allow "authenticated" users to have all permissions.

Then, for a specific project, I configured several users to have all permissions, and "authenticated" users to have no permissions.

I expected that these project-level settings for authenticated users would trump global permissions.

Instead, it had no effect.  all authenticated users could still perform all operations on this project.

Now, if in global permissions, I removed administer, build, and configure permissions for authenticated users, then the project level permissions worked as expected.

However, there's a serious downside here: by removing those permissions for authenticated users at the global level, I then have to add them for every project, which surely is not the expected behavior.


I'd expect that if authenticated users have all permissions, then all projects by default would inherit those permissions. However, the act of checking off "Enable Project Based Security" on any project should signal to Jenkins that Global permissions do not apply to this project, and that the only permissions that should apply are the ones configured for that project.

[jenkins-infra-bot]

kohsuke:

• Original comment link
• Raw content of original comment:

  As it stands now (as of 1.427), this is the expected behaviour, even though arguably this isn't very useful.
  
  The per-project matrix setting doesn't allow you veto-entry. It's combined with the global one with OR semantics.
  
  So this ticket should be considered as an RFE to introduce such behaviour, perhaps by turning per-project checkbox table into 3-state checkboxes.
  

As it stands now (as of 1.427), this is the expected behaviour, even though arguably this isn't very useful.

The per-project matrix setting doesn't allow you veto-entry. It's combined with the global one with OR semantics.

So this ticket should be considered as an RFE to introduce such behaviour, perhaps by turning per-project checkbox table into 3-state checkboxes.

[jenkins-infra-bot]

vasubhat:

• Original comment link
• Raw content of original comment:

  Has this been considered for implementation yet?
  
  In my case, I need to apply these permissions on jobs after they have been setup, and pretty much in exactly the same way as Marc Esher mentions.
  Would be easiest with the override functionality.
  

Has this been considered for implementation yet?

In my case, I need to apply these permissions on jobs after they have been setup, and pretty much in exactly the same way as Marc Esher mentions.
Would be easiest with the override functionality.

[jenkins-infra-bot]

danielbeck:

• Original comment link
• Raw content of original comment:

  Duplicates JENKINS-10593, released in Matrix Auth Plugin 1.2
  

Duplicates JENKINS-10593, released in Matrix Auth Plugin 1.2

[jenkins-infra-bot]

[Original duplicates from Jira: JENKINS-10593]