Backup a Role-Based Access Control configuration

If the CloudBees CI instance is attached to an operations center that enforces the Authorization Strategy, the nectar-rbac.xml is maintained by the operations center. In that case the RBAC settings are actually defined in the nectar-rbac.xml of the controller item on the operations center. The operations center pushes the configuration by overriding the controller’s nectar-rbac.xml whenever changes are detected.

To backup the RBAC settings of a controller with RBAC managed by an operations center, backup the nectar-rbac.xml of the controller item on the operations center ($CJOC_HOME/jobs/controller-name/nectar-rbac.xml).

Rename a client controller

Perform the following steps to rename a client controller:

Take the backup of the nectar-rbac.xml file of the controller item (for example $CJOC_HOME/jobs/old-client-controller/nectar-rbac.xml).
Release and Delete the controller item from the operations center.
Stop the controller.
Delete the following files for the controller to entirely remove the link to the operations center:
- $JENKINS_HOME/license.xml
- $JENKINS_HOME/operations-center-cloud*
- $JENKINS_HOME/operations-center-client*
- $JENKINS_HOME/com.cloudbees.opscenter.client.plugin.OperationsCenterRootAction.xml

Switch the Security realm of the controller back to Jenkins own user database by editing the $JENKINS_HOME/config.xml file.

Locate this line:

<securityRealm class="com.cloudbees.opscenter.client.plugin.OperationsCenterSsoSecurityRealm" plugin="operations-center-client@..."/>

And change it to:

<securityRealm class="hudson.security.HudsonPrivateSecurityRealm">
  <disableSignup>true</disableSignup>
  <enableCaptcha>false</enableCaptcha>
</securityRealm>

If you do not have authentication details for the controller, you can disable security entirely. However, this method should only be used when you isolate network access to the instance during the timeframe when security is disabled. To do so, modify <useSecurity>true</useSecurity> to <useSecurity>false</useSecurity>.

Start the controller.
From the operations center, create a new controller item.
Restore the nectar-rbac.xml backed up previously into the filesystem of the operations center for the new client controller (for example $CJOC_HOME/jobs/new-client-controller/nectar-rbac.xml).
Reload the controller item by appending /reload to the new controller item URL (for example $CJOC_URL/job/new-client-controller/reload), you will need to click the Retry using POST button, it will result in a blank page (indicating the reload from disk worked).
Connect the controller either by push configuration from the operations center or manually from the controller.