search

GoogleCloudPlatform / kube-jenkins-imager

Apache License 2.0
256 stars 82 forks source link

impossible to enable security #4

Closed piontec closed 8 years ago

piontec commented 9 years ago

On clean install, with SSL enabled and default basi auth credentials, you lock out yourself after enabling 'global security'.

To reproduce: 1) configure ssl_secrets.yaml to include cert, key and dh 2) in ssl_proxy.yaml - enable SSL, set to 'true' 3) wait for jenkins 4) in jenkins click:

refresh and basic auth popup with 'Jenkins' realm will appear - no idea what the credentials should be.

evandbrown commented 9 years ago

I'm able to replicate this. It looks like basic auth on the reverse proxy is causing the issue. If I disable auth on the proxy (change ENABLE_BASIC_AUTH to false in ssl_proxy.yaml, Jenkins authentication works. The proxy authN was intended to provide basic protections until the user configures Jenkins auth, so this seems like the right thing to do. LMK if that sounds right and I'll close the issue. Thanks!

alledm commented 9 years ago

Hello,

I am experiencing the same problem. Even disabling auth on the proxy, as soon as I click on "save" I am locked out.

Can you share how you setup the configuration please?

evandbrown commented 9 years ago

Hi @alledm,

I just walked through enabling Jenkins auth and have it working fine. Here's what I did:

  1. Delete the existing proxy controller in Kubernets: kubectl delete -f ssl_proxy.yaml
  2. Update ssl_proxy.yaml and change ENABLE_BASIC_AUTH to false
  3. Create a new proxy controller with the updated file: kubectl delete -f ssl_proxy.yaml
  4. Open an Incognito window and confirm you can access Jenkins without authenticating
  5. Click Manage Jenkins > Configure Global Security
  6. Under Security Realm choose "Jenkins' own user database" and "Allow users to sign up"
  7. Under Authorization choose "Logged-in users can do anything"
  8. Click Save
  9. Close and re-open the Incognito window. You should have a read-only view of the dashboard and be able to sign up for an account. Enable Matrix-based security if you'd like to do more fine-grained control

Please let me know if that works and I'll close the issue.

Thanks,

Evan