Ldap security for Jenkins CI

I recently deployed Jenkins CI on my personal server. The hardest question was what security solution should I use. As title of this post may have suggested I have chosen to use the infrastructure I already have ... LDAP. Now I would like to describe, how easy this configuration is and how it works.

My LDAP structure

My base dn is dc=effy,dc=cz. And it contains two organizationUnits ... ou=people (to hold users) and ou=groups (to hold user roles). Groups (Roles) are presented by objectClass groupOfNames, they are identified by cn. People (Users) are of objectClass inetOrgPerson, thus identified by uid.

Configuration of Jenkins

Security settings are located in Administration (/manage) -> Configuration (/configure).

The first step is enabling security settings ... that is done by checking check-box Enable security.

The second step is choosing Access Control ... in my case LDAP.

This configuration is pretty simple as long as you have the expected LDAP structure, it could be quite difficult otherwise. You can note that I had to only think about server address and root DN because other values are standards and I am using anonymous LDAP access.

The third step is configuring authorisation rules. The first option (Anyone can do anything) is probably not what you want, because than there would be no need for the LDAP in the first place. I have chosen Matrix-based security, mostly just out of curiosity as I am going to be the only user in medium-term plan.

The only trick here is, that you need to add the groups controlled yourself. Self discovery would be nice, but that is just my opinion.

Testing

Before you finally take Anonymous group the privileges to administer the Jenkins, I would recommend one test login, just to be sure. And you can easily test, what rolles are assigned to your account by visiting the /whoAmI page. This page looks like this:

An interesting and documented feature is that user is assigned two roles per LDAP role. One in upper-case with ROLE_ prefix and one named exactly as in LDAP.

Conclusion

Jenkins offers various security settings which are quite simple to use. This post describes how LDAP connection works and what are its options. I recommend always to use some sort of access control for Jenkins, even if you are going to use Logged-in users can do anything option, just to control the access to Jenkins.