Github Oauth plugin for jenkins

[shevam9]

Select Topic Area

Question

Body

I have set up github authentication in my jenkins by setting up a Oauth app in my github, but it seems that now anyone with a github account can login into my jenkins. How to restrict that to a specific no of users.

Also it is not about authorization as i don't want them logging into jenkins itself in the first place, access after that is another matter.

[markolalovic]

How did you set up the authorization strategy? In the documentation: Jenkins GitHub OAuth Plugin, you can find an explanation of how to configure different strategies.

[markolalovic]

What credentials are you using to perform connection to your Jenkins controller? "No verification" host key verification strategy is not recommended.

[shevam9]

My fellow team members are logging into the controller via jenkins UI, they are using their github credentials , they get a authorization prompt and code in their mail , so upon verifying that they are able to login into the controller. There is no such option for host key verification strategy in regards to the github Oauth plugin.

[markolalovic]

You wrote: "it seems that now anyone with a github account can login into my jenkins". Why does it seem like this, have you tested with fellow members?

[shevam9]

Yes anyone is able to log in to the controller, i tried with multiple github accounts, i can only restrict the inside access like read or overall read etc based on what authorization policy i am using but logging in is possible. I am actually looking for a way i can restrict login to specific accounts but nothing so far.

[markolalovic]

It seems like you have granted overall/administrative permission to anonymous (anyone can do anything). What you want is granting that permission to authenticated users. Perhaps check this related question and answer at server fault to try and debug your permissions.