I migrated my IDP and some users can log in on Jenkins® but they have lost their privileges

Last Reviewed:2025-12-31()
2 minute readKnowledge base

Issue

After migrating my Identity Provider (IdP):

  • Users can successfully log in to CloudBees CI but they do not have the permissions they were previously granted.

  • Users who were added to RBAC groups cannot exercise those permissions, receiving "permission denied" errors when attempting to perform actions they should be able to do.

  • Folders and resources that users should have access to are not visible in the dashboard.

Environment

Resolution

When migrating to a new Identity Provider (IdP), the Jenkins® User IDs for your users may change. If the RBAC configuration still references the old User IDs from the previous IdP, users logging in via the new IdP with their new User IDs will not match the configured RBAC group memberships, resulting in missing permissions.

To avoid this issue during IdP migrations, refer to Can I migrate my IDP and preserve the same users on Jenkins.

Follow these steps to identify and fix the User ID mismatch:

  1. Have the affected user log in to Jenkins®.

  2. Ask the user to click their username in the top-right corner, then click their username again to navigate to the Profile section.

  3. In the Profile page, locate and copy the Jenkins User ID value.

  4. Navigate to the RBAC group where the user should have permissions using the Groups icon at the root level of the controller, or within the specific folder or job where the group is defined.

  5. Compare the Jenkins User ID from step 3 with the User ID configured in the RBAC group membership.

  6. If the User IDs do not match, update the RBAC group membership with the correct Jenkins® User ID from step 3.

  7. Click Save to apply the changes.

The user’s permissions and folder visibility should be immediately restored.

Tested product/plugin versions

This article is part of our Knowledge Base and is provided for guidance-based purposes only. The solutions or workarounds described here are not officially supported by CloudBees and may not be applicable in all environments. Use at your own discretion, and test changes in a safe environment before applying them to production systems.