diff --git a/jenkins_jobs/modules/properties.py b/jenkins_jobs/modules/properties.py index bbf4247ca..6aaaf51b7 100644 --- a/jenkins_jobs/modules/properties.py +++ b/jenkins_jobs/modules/properties.py @@ -530,10 +530,24 @@ def authenticated_build(registry, xml_parent, data): def authorization(registry, xml_parent, data, job_data): """yaml: authorization Specifies an authorization matrix + In 3.0 version of plugin was added support for explicitly assigning permissions + to groups or users with a given name to prevent confusion when names match either. .. _authorization: + For *matrix-auth >= 3.0* + + :arg list prefix:: + * `prefix` + * **GROUP** + * **USER** + * `` is the name of the group or user, containing + + For *matrix-auth < 3.0* + :arg list : `` is the name of the group or user, containing + + the list of rights to grant. : rights: @@ -610,7 +624,16 @@ def authorization(registry, xml_parent, data, job_data): for perm in perms: pe = XML.SubElement(matrix, "permission") try: - pe.text = "{0}:{1}".format(mapping[perm], username) + if username.upper().startswith( + "GROUP:" + ) or username.upper().startswith("USER:"): + pe.text = "{0}:{1}:{2}".format( + username.split(":")[0].upper(), + mapping[perm], + username.split(":")[1], + ) + else: + pe.text = "{0}:{1}".format(mapping[perm], username) except KeyError: raise InvalidAttributeError(username, perm, mapping.keys()) diff --git a/tests/properties/fixtures/authorization.xml b/tests/properties/fixtures/authorization.xml index 593dfa848..33892d903 100644 --- a/tests/properties/fixtures/authorization.xml +++ b/tests/properties/fixtures/authorization.xml @@ -3,27 +3,30 @@ - com.cloudbees.plugins.credentials.CredentialsProvider.Create:admin - com.cloudbees.plugins.credentials.CredentialsProvider.Delete:admin - com.cloudbees.plugins.credentials.CredentialsProvider.ManageDomains:admin - com.cloudbees.plugins.credentials.CredentialsProvider.Update:admin - com.cloudbees.plugins.credentials.CredentialsProvider.View:admin - hudson.model.Item.Build:admin - hudson.model.Item.Cancel:admin - hudson.model.Item.Configure:admin - hudson.model.Item.Delete:admin - hudson.model.Item.Discover:admin - hudson.model.Item.Move:admin - hudson.model.Item.Read:admin - hudson.model.Item.ViewStatus:admin - hudson.model.Item.Workspace:admin - com.synopsys.arc.jenkins.plugins.ownership.OwnershipPlugin.Jobs:admin - hudson.model.Run.Delete:admin - hudson.model.Run.Replay:admin - hudson.model.Run.Update:admin - hudson.scm.SCM.Tag:admin - hudson.model.Item.Read:anonymous - hudson.model.Item.ExtendedRead:anonymous + USER:com.cloudbees.plugins.credentials.CredentialsProvider.Create:admin + USER:com.cloudbees.plugins.credentials.CredentialsProvider.Delete:admin + USER:com.cloudbees.plugins.credentials.CredentialsProvider.ManageDomains:admin + USER:com.cloudbees.plugins.credentials.CredentialsProvider.Update:admin + USER:com.cloudbees.plugins.credentials.CredentialsProvider.View:admin + USER:hudson.model.Item.Build:admin + USER:hudson.model.Item.Cancel:admin + USER:hudson.model.Item.Configure:admin + USER:hudson.model.Item.Delete:admin + USER:hudson.model.Item.Discover:admin + USER:hudson.model.Item.Move:admin + USER:hudson.model.Item.Read:admin + USER:hudson.model.Item.ViewStatus:admin + USER:hudson.model.Item.Workspace:admin + USER:com.synopsys.arc.jenkins.plugins.ownership.OwnershipPlugin.Jobs:admin + USER:hudson.model.Run.Delete:admin + USER:hudson.model.Run.Replay:admin + USER:hudson.model.Run.Update:admin + USER:hudson.scm.SCM.Tag:admin + GROUP:hudson.model.Item.Read:anonymous + GROUP:hudson.model.Item.ExtendedRead:anonymous + hudson.model.Item.Read:authenticated + hudson.model.Item.Discover:authenticated + hudson.model.Item.ExtendedRead:authenticated diff --git a/tests/properties/fixtures/authorization.yaml b/tests/properties/fixtures/authorization.yaml index 94b6c34ac..ea8ce7d6f 100644 --- a/tests/properties/fixtures/authorization.yaml +++ b/tests/properties/fixtures/authorization.yaml @@ -1,6 +1,6 @@ properties: - authorization: - admin: + USER:admin: - credentials-create - credentials-delete - credentials-manage-domains @@ -20,6 +20,10 @@ properties: - run-replay - run-update - scm-tag - anonymous: + GROUP:anonymous: - job-read - job-extended-read + authenticated: + - job-read + - job-discover + - job-extended-read diff --git a/tests/properties/fixtures/authorization_matrix.xml b/tests/properties/fixtures/authorization_matrix.xml index 6404b1423..e42e15387 100644 --- a/tests/properties/fixtures/authorization_matrix.xml +++ b/tests/properties/fixtures/authorization_matrix.xml @@ -3,20 +3,22 @@ - hudson.model.Item.Delete:admin - hudson.model.Item.Configure:admin - hudson.model.Item.Read:admin - hudson.model.Item.Discover:admin - hudson.model.Item.Build:admin - hudson.model.Item.Workspace:admin - hudson.model.Item.Cancel:admin - hudson.model.Run.Delete:admin - hudson.model.Run.Replay:admin - hudson.model.Run.Update:admin - hudson.scm.SCM.Tag:admin - hudson.model.Item.Discover:anonymous - hudson.model.Item.Read:anonymous - hudson.model.Item.ExtendedRead:anonymous + USER:hudson.model.Item.Delete:admin + USER:hudson.model.Item.Configure:admin + USER:hudson.model.Item.Read:admin + USER:hudson.model.Item.Discover:admin + USER:hudson.model.Item.Build:admin + USER:hudson.model.Item.Workspace:admin + USER:hudson.model.Item.Cancel:admin + USER:hudson.model.Run.Delete:admin + USER:hudson.model.Run.Replay:admin + USER:hudson.model.Run.Update:admin + USER:hudson.scm.SCM.Tag:admin + GROUP:hudson.model.Item.Discover:anonymous + GROUP:hudson.model.Item.Read:anonymous + GROUP:hudson.model.Item.ExtendedRead:anonymous + hudson.model.Item.Discover:authenticated + hudson.model.Item.Read:authenticated diff --git a/tests/properties/fixtures/authorization_matrix.yaml b/tests/properties/fixtures/authorization_matrix.yaml index 61dc70ca2..4f56a5eb3 100644 --- a/tests/properties/fixtures/authorization_matrix.yaml +++ b/tests/properties/fixtures/authorization_matrix.yaml @@ -1,6 +1,6 @@ properties: - authorization: - admin: + USER:admin: - job-delete - job-configure - job-read @@ -12,7 +12,10 @@ properties: - run-replay - run-update - scm-tag - anonymous: + GROUP:anonymous: - job-discover - job-read - job-extended-read + authenticated: + - job-discover + - job-read