Security recommendations

CloudBees Jenkins Operations Center (CJOC) uses the standard Jenkins security model. In other words there are two axes to security:

  • The security realm - which is responsible for identifying the user and reporting on any groups that are defined in the security realm that the user belongs to

  • The authorization strategy - which is responsible for determining the set of permissions that an identified user has on any specific object within the Jenkins object tree.

There are three modes you can select between with CloudBees Jenkins Operations Center:

  1. All Jenkins Client Masters are independent and can chose their own security realms and authorization strategies

  2. All Jenkins Client Masters will be forced to delegate their security realm to Operations Center but can choose their own authorization strategies.

  3. All Jenkins Client Masters will be forced to delegate their security realm to Operations Center and will be forced to use the same authorization strategy configuration as Operations Center.

Finally, authorization strategies that are Operations Center-aware (at the time of writing the only such authorization strategy is the CloudBees Role Based Access Control Plugin) can contextualize the authorization strategy configuration of individual Client Masters based on the context within Operations Center that the Client Master is defined in.

The following recommendations provide the greatest functionality and flexibility as well as a secure setup:

  • Enable security

  • Select any security realm

  • Select the CloudBees Role Based Access Control Plugin as the authorization strategy

  • Select a markup formatter

  • Enable prevention of cross site request forgery exploits

  • Enforce 0 on-master executors as jobs running on a master to prevent jobs running on the master from modifying the master’s configuration

  • Select Single Sign-On (security realm and authorization strategy) for the security settings enforcement policy

    This option requires that all masters have a well configured Jenkins URL (in Manage Jenkins > Configure System > Jenkins URL). For more information see Using Single Sign On (SSO).
  • If you are integrating existing Client Masters into Operations Center, it may be beneficial to allow Client Masters to opt-out of the security settings enforcement policy while you decide how to transition their existing configuration to a Operations Center managed configuration.

  • Select the appropriate default authentication mapping strategy. If you have different classes of masters you will want to enable per-master configuration of authentication mapping. Where all masters are managed by the Operations Center administrators then Trusted master with equivalent security realm is likely appropriate. Selecting Restricted master with equivalent security realm is appropriate for low risk masters where the team(s) using the master have root access to the master. Select Untrusted master with equivalent security realm if you have higher risk masters.

    The choice of authentication mapping strategy may affect the ability of some functionality.

    For example, a master that has the Untrusted master with equivalent security realm will only be able to see other Client Masters that are visible to unauthenticated users and the remote job trigger functionality from that master will only be able to trigger jobs that can be triggered by unauthenticated users.

  • Enable Agent → Master Access Control (you will also want to enable this on all masters).

recommended config
Figure 1. Recommended configuration