title: Jenkins: 'Trigger Builds Remotely' with ?token not working when Matrix Authorization Strategy is used
body: <p>I'm having a problem with triggering builds in <a href="http://jenkins-ci.org">Jenkins</a> with authentication enabled and wondering if anyone has ideas.</p>
  
  <p>I have Global Security configured to use LDAP with "Project-based Matrix Authorization Strategy" enabled. The "Anonymous" user has the "Job > Build" privilege, and no other privileges (in particular, the "Anonymous" user does NOT have "Overall > Read" privilege, since I don't want everyone to be able to view the list of jobs and other general information).</p>
  
  <p>I want an automated script to be able to trigger a build using the "Trigger Builds Remotely" feature, where I specify a <code>?token=[token]</code> value in the URL and the standard authentication should be bypassed, as long as the <code>[token]</code> value matches the one I set in the job's Configure page. The goal is to <em>NOT</em> need to provide a regular username/password in the request but simply provide the token for this specific job.</p>
  
  <p>The documentation seems to indicate this should work:<br>
  <a href="https://wiki.jenkins-ci.org/display/JENKINS/Quick+and+Simple+Security">https://wiki.jenkins-ci.org/display/JENKINS/Quick+and+Simple+Security</a></p>
  
  <p>So specifically, I am expecting this HTTP request to work:</p>
  
  <pre><code>curl -i https://jenkinsHost/job/ProjectName/build?token=test
  </code></pre>
  
  <p>But I get:</p>
  
  <pre><code>[~]$ curl -i https://jenkinsHost/job/ProjectName/build?token=test
  HTTP/1.1 403 Forbidden
  Date: Sat, 27 Apr 2013 23:17:03 GMT
  Server: Winstone Servlet Engine v0.9.10
  Content-Type: text/html;charset=UTF-8
  Content-Length: 629
  X-Powered-By: Servlet/2.5 (Winstone/0.9.10)
  Set-Cookie: JSESSIONID.e9bc4765=e1f0a30b9f04b3740bae527a7822b2d5; Path=/; HttpOnly
  Connection: close
  
  &lt;html&gt;&lt;head&gt;&lt;meta http-equiv='refresh' content='1;url=/login?from=%2Fjob%2FProjectName%2Fbuild%3Ftoken%3Dtest'/&gt;
  &lt;script&gt;
  window.location.replace('/login?from=%2Fjob%2FProjectName%2Fbuild%3Ftoken%3Dtest');&lt;/script&gt;
  &lt;/head&gt;
  &lt;body style='background-color:white; color:white;'&gt;
  Authentication required
  &lt;/body&gt;&lt;/html&gt;
  </code></pre>
  
  <p>When I <em>DO</em> use API authentication, the request works:</p>
  
  <pre><code>curl --username "test_user:API_KEY" https://hostname/job/ProjectName/build?token=test
  </code></pre>
  
  <p>But again, according to the documentation I think it is supposed to bypass the global authentication if ?token is present and matches the project token I configure. Why is this not working? What other information/logs can I provide?</p>