Issue
On a High Availability (active/active) controller, pages intermittently appear blank, or render only partially, for a user who has the Job/Discover permission but not the Job/Read permission on a folder.
The issue only occurs while a build from that folder is queued or running.
The following warning and stack trace appear in the controller logs:
WARNING o.e.j.e.n.ContextHandler$APIContext#log: Error while serving ... org.springframework.security.access.AccessDeniedException: Please login to access job ... at jenkins.model.Jenkins.getItem(Jenkins.java:3047) at jenkins.model.Jenkins.getItem(Jenkins.java:355) at jenkins.model.Jenkins.getItemByFullName(Jenkins.java:3154) at jenkins.model.Jenkins.getItemByFullName(Jenkins.java:3173) at PluginClassLoader for cloudbees-replication//com.cloudbees.jenkins.plugins.replication.ui.ReplicatedComputers$RemoteTask.resolveOwner(ReplicatedComputers.java:628) at PluginClassLoader for cloudbees-replication//com.cloudbees.jenkins.plugins.replication.ui.ReplicatedComputers$RemoteTask.hasReadPermission(ReplicatedComputers.java:622) ...
Because the Build Executor Status sidebar widget is included on every page, this uncaught exception can break page rendering across the whole controller, not just on pages related to the restricted folder.
When the current user has Job/Discover but not Job/Read for the folder containing one of those builds, this check throws an uncaught AccessDeniedException instead of concealing the build or rendering it as Unknown Pipeline node step.
Workaround
If you cannot upgrade immediately:
-
In the operations center, navigate to
-
Uncheck
Job/Discoverfor any role that is grantedJob/Discoverbut hasJob/Readfiltered away on one or more folders. -
Save.
Removing Job/Discover from a role does not reduce access for users who still have Job/Read, since Job/Discover is implied by Job/Read.
|