In Role-Based Access Control (RBAC), the Group/View and Group/Manage permissions control the ability to view and manage group membership, respectively, including service account members. These same permissions also control viewing and managing service account definitions and tokens at the corresponding scope. Therefore, permissions can be scoped differently at root and item levels. For example, a user might be configured with one of the following:
-
Full permissions at the root scope.
-
View-only permissions at root with full permissions in a specific folder.
-
No root access but full permissions within a specific folder.
| Creating and deleting service accounts, and creating and deleting their tokens, is governed by the Group/Manage permission, because managing service accounts is considered part of managing group membership. |
CloudBees CI never stores service account tokens. Only a SHA-256 cryptographic hash of each token is stored for authentication verification. A user with the Group/Manage permission at a service account’s scope may create or delete tokens, but cannot view existing token values. If a token is lost, it must be deleted and a new one created.
Mitigate token abuse by former users
Since a service account and its tokens exist independently of any human user, there is a risk that a service account token could be used by a former employee or contractor after their departure.
To mitigate this risk:
-
Use expiring tokens to limit the window of potential abuse.
-
When revoking a user’s access to CloudBees CI, delete and recreate any tokens they might have created or had access to. The token listing for a service account shows who created each token.
| Abuse is normally only possible if the former user continues to have physical access to the CloudBees CI instance. In many organizations, CloudBees CI is hosted in a secure network inaccessible to former personnel. |
Restrict token creation permissions
If there is concern about token abuse, you can restrict the Group/CreateToken permission to a limited set of trusted administrators. This permission is required to create new tokens for any service account. However, the Group/CreateToken permission does not control:
-
Creating service accounts.
-
Adding service accounts to groups.
-
Deleting tokens.
The Group/CreateToken permission is always checked at the root scope, even for item-scoped service accounts. This means users with full folder permissions cannot grant themselves token creation capabilities through an item-scoped group. This permission is required in addition to Group/Manage permission on the service account’s scope.