Bug 1654846

Summary: ClassCastException when using FullControlOnceLoggedInAuthorizationStrategy
Product: OpenShift Container Platform Reporter: Robert Bost <rbost>
Component: BuildAssignee: Gabe Montero <gmontero>
Status: CLOSED ERRATA QA Contact: wewang <wewang>
Severity: high Docs Contact:
Priority: high    
Version: 3.11.0CC: aos-bugs, bparees, rbost, wzheng
Target Milestone: ---   
Target Release: 4.1.0   
Hardware: Unspecified   
OS: Unspecified   
Fixed In Version: Doc Type: Known Issue
Doc Text:
Cause: The openshift jenkins login plugin only supports the global matrix authorization strategy. Consequence: Use of the full control once logged in strategy will result in an error. Workaround (if any): Either disable the oauth integration if you want to use full control, us the 4.0 feature to control role to permission mapping Or open an RFE for explicit support. Result: You can log into jenkins.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-04 10:41:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Robert Bost 2018-11-29 19:50:10 UTC
Description of problem:

Logging into Jenkins using OpenShift OAuth2 results in ClassCastException when using FullControlOnceLoggedInAuthorizationStrategy:

java.lang.ClassCastException: hudson.security.FullControlOnceLoggedInAuthorizationStrategy cannot be cast to hudson.security.GlobalMatrixAuthorizationStrategy
	at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm.updateAuthorizationStrategy(OpenShiftOAuth2SecurityRealm.java:769)
	at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm$6.onSuccess(OpenShiftOAuth2SecurityRealm.java:684)
	at org.openshift.jenkins.plugins.openshiftlogin.OAuthSession.doFinishLogin(OAuthSession.java:129)
	at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm.doFinishLogin(OpenShiftOAuth2SecurityRealm.java:947)
	at java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:627)
	at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:343)
	at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:184)
	at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:117)
	at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:129)
	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:715)

Version-Release number of selected component (if applicable): 


How reproducible: Always

Steps to Reproduce:
1. Configure Jenkins to use FullControlOnceLoggedInAuthorizationStrategy
   - This can be enabled via Jenkins Web UI at https://jenkins.openshift.example.com/configureSecurity/
   - Authorization section
   - "Logged-in users can do anything" radio button
2. Log out 
3. Log back in, see stack trace (above) in browser.

Additional info:
- Offending line is https://github.com/openshift/jenkins-openshift-login-plugin/blob/d64c6aac9dec4217fde9084d91b4af3a74e07ffb/src/main/java/org/openshift/jenkins/plugins/openshiftlogin/OpenShiftOAuth2SecurityRealm.java#L917

Comment 1 Gabe Montero 2018-11-29 20:27:04 UTC
It would be a new feature level change to support that strategy.

At most, we could clear up the documentation and be explicit about not supporting it with a defect bugzilla.

Additionally the customer can get an RFE into the pipeline.

Comment 2 Gabe Montero 2018-11-29 20:29:59 UTC
The can of course disable the oauth integration and use default jenkins authentication as an alternative if that is viable in their env.

Comment 4 Gabe Montero 2018-12-05 01:03:35 UTC
The doc change has merged.

Moving to verified.

Comment 6 Robert Bost 2018-12-14 20:51:51 UTC
Opened bz1659642 on behalf of customer.

Comment 9 errata-xmlrpc 2019-06-04 10:41:04 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.