jenkins slave runs as user

Question

I have a jenkins setup with multiple users which are logging in with Active Directory plugin. This is useful so that each user can access his own tasks.

However each user also has different permissions on the local network, such as access to different folders etc. I have noticed that the permissions given to each task is not linked to the user but to the account under which the slave is running as service. Is there a way to change that so that the task is executed on the slave under the credential (and hence permissions) of the user?

Thank you

Solution 1

The problem is: there is only one slave process running the different job assigned to that server by the Jenkins master.
So the slave itself runs as one user (generally, a dedicated account or a system account).

Since you can get the user id as environment variable (with a plugin like JENKINS Build User Vars Plugin), you might consider configuring the job in order for it build step to "run as" the user who triggered the build.
See for instance the JENKINS Authorize Project plugin.

However, as mentioned this answer:

The "Authorize Project" plugin does not change the OS level user that is running commands.
It only sets the Jenkins user that is running the job and any downstream jobs, using Jenkins authentication (whatever it might be).

So you are left with build step with runas or su -c commands in order to be sure that your task does run with the right user.

Solution 2

I had the similar issue and I can recall for managing more control on projects I used role strategy plugin and setup global security using LDAP servers (Active directory should also be ok). And I used authorized project plugin. Have a look and I hope it should solve your purpose. Let me know on comment section for any clarification.

Solution 3

you can partially fix your problem this way:

• install the slave as a service using the Java Web Start method and JLNP
• go to Services control panel in windows
• under Properties -> Connection replace the local system connection with a specific user
• rebooted the service

This at least gives you the ability to use one account instead of system.

Comments

[VonC]

For Windows runas, for instance, see jenkins-ci.361315.n4.nabble.com/… and the /savecred option.

[RockScience]

Unfortunately "Authorize-project plugin controls only authorizations of Jenkins, not those of OS."