{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/jenkins-openshift-login-plugin/issues/44","repository_url":"https://api.github.com/repos/openshift/jenkins-openshift-login-plugin","labels_url":"https://api.github.com/repos/openshift/jenkins-openshift-login-plugin/issues/44/labels{/name}","comments_url":"https://api.github.com/repos/openshift/jenkins-openshift-login-plugin/issues/44/comments","events_url":"https://api.github.com/repos/openshift/jenkins-openshift-login-plugin/issues/44/events","html_url":"https://github.com/openshift/jenkins-openshift-login-plugin/issues/44","id":365982382,"node_id":"MDU6SXNzdWUzNjU5ODIzODI=","number":44,"title":"Jenkins blocks edit role's Jenkins.RUN_SCRIPTS permission without Jenkins.ADMINISTER permission due to matrix-auth-plugin","user":{"login":"andyfeller","id":2089743,"node_id":"MDQ6VXNlcjIwODk3NDM=","avatar_url":"https://avatars1.githubusercontent.com/u/2089743?v=4","gravatar_id":"","url":"https://api.github.com/users/andyfeller","html_url":"https://github.com/andyfeller","followers_url":"https://api.github.com/users/andyfeller/followers","following_url":"https://api.github.com/users/andyfeller/following{/other_user}","gists_url":"https://api.github.com/users/andyfeller/gists{/gist_id}","starred_url":"https://api.github.com/users/andyfeller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andyfeller/subscriptions","organizations_url":"https://api.github.com/users/andyfeller/orgs","repos_url":"https://api.github.com/users/andyfeller/repos","events_url":"https://api.github.com/users/andyfeller/events{/privacy}","received_events_url":"https://api.github.com/users/andyfeller/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"gabemontero","id":3594868,"node_id":"MDQ6VXNlcjM1OTQ4Njg=","avatar_url":"https://avatars0.githubusercontent.com/u/3594868?v=4","gravatar_id":"","url":"https://api.github.com/users/gabemontero","html_url":"https://github.com/gabemontero","followers_url":"https://api.github.com/users/gabemontero/followers","following_url":"https://api.github.com/users/gabemontero/following{/other_user}","gists_url":"https://api.github.com/users/gabemontero/gists{/gist_id}","starred_url":"https://api.github.com/users/gabemontero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gabemontero/subscriptions","organizations_url":"https://api.github.com/users/gabemontero/orgs","repos_url":"https://api.github.com/users/gabemontero/repos","events_url":"https://api.github.com/users/gabemontero/events{/privacy}","received_events_url":"https://api.github.com/users/gabemontero/received_events","type":"User","site_admin":false},"assignees":[{"login":"gabemontero","id":3594868,"node_id":"MDQ6VXNlcjM1OTQ4Njg=","avatar_url":"https://avatars0.githubusercontent.com/u/3594868?v=4","gravatar_id":"","url":"https://api.github.com/users/gabemontero","html_url":"https://github.com/gabemontero","followers_url":"https://api.github.com/users/gabemontero/followers","following_url":"https://api.github.com/users/gabemontero/following{/other_user}","gists_url":"https://api.github.com/users/gabemontero/gists{/gist_id}","starred_url":"https://api.github.com/users/gabemontero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gabemontero/subscriptions","organizations_url":"https://api.github.com/users/gabemontero/orgs","repos_url":"https://api.github.com/users/gabemontero/repos","events_url":"https://api.github.com/users/gabemontero/events{/privacy}","received_events_url":"https://api.github.com/users/gabemontero/received_events","type":"User","site_admin":false}],"milestone":null,"comments":4,"created_at":"2018-10-02T16:36:05Z","updated_at":"2018-10-02T18:36:27Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"[org.openshift.jenkins.plugins.openshiftlogin.OpenShiftOAuth2SecurityRealm. updateAuthorizationStrategy()](https://github.com/openshift/jenkins-openshift-login-plugin/blob/master/src/main/java/org/openshift/jenkins/plugins/openshiftlogin/OpenShiftOAuth2SecurityRealm.java#L840) grants those with `edit` OpenShift role the `Jenkins.RUN_SCRIPTS` permission, which I was banking on, however the [jenkinsci/matrix-auth-plugin](https://github.com/jenkinsci/matrix-auth-plugin/blob/master/src/main/resources/hudson/security/DangerousMatrixPermissionsAdministrativeMonitor/message.properties) denies this permission without `Jenkins.ADMINISTER`.  So I'm a little torn because I want the ability to run scripts for edit purposes because my system administrators won't give us `admin` role for service accounts and we need to configure Jenkins in a non-static way.\r\n\r\nThoughts?"},"comment":{"url":"https://api.github.com/repos/openshift/jenkins-openshift-login-plugin/issues/comments/426384310","html_url":"https://github.com/openshift/jenkins-openshift-login-plugin/issues/44#issuecomment-426384310","issue_url":"https://api.github.com/repos/openshift/jenkins-openshift-login-plugin/issues/44","id":426384310,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNjM4NDMxMA==","user":{"login":"gabemontero","id":3594868,"node_id":"MDQ6VXNlcjM1OTQ4Njg=","avatar_url":"https://avatars0.githubusercontent.com/u/3594868?v=4","gravatar_id":"","url":"https://api.github.com/users/gabemontero","html_url":"https://github.com/gabemontero","followers_url":"https://api.github.com/users/gabemontero/followers","following_url":"https://api.github.com/users/gabemontero/following{/other_user}","gists_url":"https://api.github.com/users/gabemontero/gists{/gist_id}","starred_url":"https://api.github.com/users/gabemontero/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gabemontero/subscriptions","organizations_url":"https://api.github.com/users/gabemontero/orgs","repos_url":"https://api.github.com/users/gabemontero/repos","events_url":"https://api.github.com/users/gabemontero/events{/privacy}","received_events_url":"https://api.github.com/users/gabemontero/received_events","type":"User","site_admin":false},"created_at":"2018-10-02T18:36:27Z","updated_at":"2018-10-02T18:36:27Z","author_association":"CONTRIBUTOR","body":"Nothing as I understand it what `Jenkins.ADMINISTER` means.\r\n\r\nSome research needs to be done with the latest combinations about what happens when you remove `Jenkins.RUN_SCRIPTS`.  I recalled that was needed to run pipelines, but that should be confirmed.  Perhaps that is no longer the case.  Looking at core usage today, I believe it is needed for groovy init scripts, which we use today as part of our image startup, and which image extenders are using.  So would have to validate that path as well."}}
{"actor":{"display_login":"gabemontero"}}