Bug 1654846
| Summary: | ClassCastException when using FullControlOnceLoggedInAuthorizationStrategy | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Robert Bost <rbost> |
| Component: | Build | Assignee: | Gabe Montero <gmontero> |
| Status: | CLOSED ERRATA | QA Contact: | wewang <wewang> |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | 3.11.0 | CC: | aos-bugs, bparees, rbost, wzheng |
| Target Milestone: | --- | ||
| Target Release: | 4.1.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Known Issue | |
| Doc Text: |
Cause: The openshift jenkins login plugin only supports the global matrix authorization strategy.
Consequence: Use of the full control once logged in strategy will result in an error.
Workaround (if any): Either disable the oauth integration if you want to use full control, us the 4.0 feature to control role to permission mapping
Or open an RFE for explicit support.
Result: You can log into jenkins.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-04 10:41:04 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
It would be a new feature level change to support that strategy. At most, we could clear up the documentation and be explicit about not supporting it with a defect bugzilla. Additionally the customer can get an RFE into the pipeline. The can of course disable the oauth integration and use default jenkins authentication as an alternative if that is viable in their env. The doc change has merged. Moving to verified. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:0758 |
Description of problem: Logging into Jenkins using OpenShift OAuth2 results in ClassCastException when using FullControlOnceLoggedInAuthorizationStrategy: java.lang.ClassCastException: hudson.security.FullControlOnceLoggedInAuthorizationStrategy cannot be cast to hudson.security.GlobalMatrixAuthorizationStrategy at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm.updateAuthorizationStrategy(OpenShiftOAuth2SecurityRealm.java:769) at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm$6.onSuccess(OpenShiftOAuth2SecurityRealm.java:684) at org.openshift.jenkins.plugins.openshiftlogin.OAuthSession.doFinishLogin(OAuthSession.java:129) at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm.doFinishLogin(OpenShiftOAuth2SecurityRealm.java:947) at java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:627) at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:343) at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:184) at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:117) at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:129) at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58) at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:715) ... Version-Release number of selected component (if applicable): org.openshift.jenkins.openshift-login v1.0.* How reproducible: Always Steps to Reproduce: 1. Configure Jenkins to use FullControlOnceLoggedInAuthorizationStrategy - This can be enabled via Jenkins Web UI at https://jenkins.openshift.example.com/configureSecurity/ - Authorization section - "Logged-in users can do anything" radio button 2. Log out 3. Log back in, see stack trace (above) in browser. Additional info: - Offending line is https://github.com/openshift/jenkins-openshift-login-plugin/blob/d64c6aac9dec4217fde9084d91b4af3a74e07ffb/src/main/java/org/openshift/jenkins/plugins/openshiftlogin/OpenShiftOAuth2SecurityRealm.java#L917