Bug 1654846 - ClassCastException when using FullControlOnceLoggedInAuthorizationStrategy
Summary: ClassCastException when using FullControlOnceLoggedInAuthorizationStrategy
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Build
Version: 3.11.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 4.1.0
Assignee: Gabe Montero
QA Contact: wewang
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-11-29 19:50 UTC by Robert Bost
Modified: 2019-06-04 10:41 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Known Issue
Doc Text:
Cause: The openshift jenkins login plugin only supports the global matrix authorization strategy. Consequence: Use of the full control once logged in strategy will result in an error. Workaround (if any): Either disable the oauth integration if you want to use full control, us the 4.0 feature to control role to permission mapping Or open an RFE for explicit support. Result: You can log into jenkins.
Clone Of:
Environment:
Last Closed: 2019-06-04 10:41:04 UTC
Target Upstream Version:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 3724551 0 None None None 2018-11-29 19:59:23 UTC
Red Hat Product Errata RHBA-2019:0758 0 None None None 2019-06-04 10:41:09 UTC

Description Robert Bost 2018-11-29 19:50:10 UTC 
Description of problem:

Logging into Jenkins using OpenShift OAuth2 results in ClassCastException when using FullControlOnceLoggedInAuthorizationStrategy:

java.lang.ClassCastException: hudson.security.FullControlOnceLoggedInAuthorizationStrategy cannot be cast to hudson.security.GlobalMatrixAuthorizationStrategy
	at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm.updateAuthorizationStrategy(OpenShiftOAuth2SecurityRealm.java:769)
	at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm$6.onSuccess(OpenShiftOAuth2SecurityRealm.java:684)
	at org.openshift.jenkins.plugins.openshiftlogin.OAuthSession.doFinishLogin(OAuthSession.java:129)
	at org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm.doFinishLogin(OpenShiftOAuth2SecurityRealm.java:947)
	at java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:627)
	at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:343)
	at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:184)
	at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:117)
	at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:129)
	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:715)
        ...

Version-Release number of selected component (if applicable): 

org.openshift.jenkins.openshift-login 
v1.0.* 


How reproducible: Always


Steps to Reproduce:
1. Configure Jenkins to use FullControlOnceLoggedInAuthorizationStrategy
   - This can be enabled via Jenkins Web UI at https://jenkins.openshift.example.com/configureSecurity/
   - Authorization section
   - "Logged-in users can do anything" radio button
2. Log out 
3. Log back in, see stack trace (above) in browser.

Additional info:
- Offending line is https://github.com/openshift/jenkins-openshift-login-plugin/blob/d64c6aac9dec4217fde9084d91b4af3a74e07ffb/src/main/java/org/openshift/jenkins/plugins/openshiftlogin/OpenShiftOAuth2SecurityRealm.java#L917
Comment 1 Gabe Montero 2018-11-29 20:27:04 UTC 
It would be a new feature level change to support that strategy.

At most, we could clear up the documentation and be explicit about not supporting it with a defect bugzilla.

Additionally the customer can get an RFE into the pipeline.
Comment 2 Gabe Montero 2018-11-29 20:29:59 UTC 
The can of course disable the oauth integration and use default jenkins authentication as an alternative if that is viable in their env.
Comment 4 Gabe Montero 2018-12-05 01:03:35 UTC 
The doc change has merged.

Moving to verified.
Comment 6 Robert Bost 2018-12-14 20:51:51 UTC 
Opened bz1659642 on behalf of customer.
Comment 9 errata-xmlrpc 2019-06-04 10:41:04 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0758
Note You need to log in before you can comment on or make changes to this bug.