Users, Roles and Permissions

// Run this in the Jenkins Script Console at /script
// or via: java -jar jenkins-cli.jar ... groovy = < rbac-setup.groovy
// Requires the role-strategy plugin to be installed

import jenkins.model.Jenkins
import com.michelin.cio.hudson.plugins.rolestrategy.*
import org.jenkinsci.plugins.rolestrategy.permissions.PermissionHelper

def j = Jenkins.instance

// Switch to Role-Based Authorization Strategy
def strategy = new RoleBasedAuthorizationStrategy()

// -------------------------------------------------------
// STEP 1: Define Global Roles
// Global roles control access to Jenkins-wide features
// -------------------------------------------------------

// Admin role — full Jenkins control
def adminPermissions = new HashSet([
    Permission.fromId('hudson.model.Hudson.Administer')
])
def adminRole = new Role('admin', adminPermissions)
strategy.addRole(RoleType.Global, adminRole)

// Developer role — read Jenkins + build jobs
def developerPermissions = new HashSet([
    Permission.fromId('hudson.model.Hudson.Read'),
    Permission.fromId('hudson.model.Item.Build'),
    Permission.fromId('hudson.model.Item.Read'),
    Permission.fromId('hudson.model.Item.Cancel'),
    Permission.fromId('hudson.model.Run.Update'),
])
def developerRole = new Role('developer', developerPermissions)
strategy.addRole(RoleType.Global, developerRole)

// Viewer role — read-only access
def viewerPermissions = new HashSet([
    Permission.fromId('hudson.model.Hudson.Read'),
    Permission.fromId('hudson.model.Item.Read'),
])
def viewerRole = new Role('viewer', viewerPermissions)
strategy.addRole(RoleType.Global, viewerRole)

// -------------------------------------------------------
// STEP 2: Define Item Roles (team-scoped job access)
// The pattern is a regex — jobs matching it are accessible
// -------------------------------------------------------

// Payments team — can build and read payments-* jobs only
def paymentsPermissions = new HashSet([
    Permission.fromId('hudson.model.Item.Build'),
    Permission.fromId('hudson.model.Item.Read'),
    Permission.fromId('hudson.model.Item.Cancel'),
])
// 'payments-.*' matches: payments-service-build, payments-api-deploy, etc.
def paymentsItemRole = new Role('payments-team', 'payments-.*', paymentsPermissions)
strategy.addRole(RoleType.Project, paymentsItemRole)

// Frontend team — can build and read frontend-* jobs only
def frontendItemRole = new Role('frontend-team', 'frontend-.*', paymentsPermissions)
strategy.addRole(RoleType.Project, frontendItemRole)

// -------------------------------------------------------
// STEP 3: Assign users to roles
// -------------------------------------------------------

strategy.assignRole(RoleType.Global, 'admin',     'platform-eng-alice')
strategy.assignRole(RoleType.Global, 'developer', 'dev-sarah')
strategy.assignRole(RoleType.Global, 'developer', 'dev-omar')
strategy.assignRole(RoleType.Global, 'viewer',    'contractor-raj')  // Monday's new contractor

// Item role assignments — in addition to the global developer role
strategy.assignRole(RoleType.Project, 'payments-team', 'dev-sarah')
strategy.assignRole(RoleType.Project, 'frontend-team', 'dev-omar')

// -------------------------------------------------------
// STEP 4: Apply and save
// -------------------------------------------------------

j.authorizationStrategy = strategy
j.save()

println "RBAC configured successfully"
println "Roles:"
println "  admin     → platform-eng-alice (full control)"
println "  developer → dev-sarah (all Jenkins + payments-* jobs)"
println "  developer → dev-omar  (all Jenkins + frontend-* jobs)"
println "  viewer    → contractor-raj (read-only, no build access)"

# List all users currently in Jenkins
java -jar jenkins-cli.jar \
  -s http://jenkins-master-01:8080 \
  -auth admin:your-api-token \
  list-credentials-as-xml system::system::jenkins _ 2>/dev/null || \
java -jar jenkins-cli.jar \
  -s http://jenkins-master-01:8080 \
  -auth admin:your-api-token \
  groovy = << 'EOF'
import jenkins.model.Jenkins
import hudson.model.User

// List all Jenkins users with their full names
User.getAll().each { user ->
    println "${user.id.padRight(25)} ${user.fullName}"
}
println "\nTotal users: ${User.getAll().size()}"
EOF

# Create a new user via the Groovy script console
# Useful for scripting team onboarding
java -jar jenkins-cli.jar \
  -s http://jenkins-master-01:8080 \
  -auth admin:your-api-token \
  groovy = << 'EOF'
import jenkins.model.Jenkins
import hudson.model.User
import hudson.security.HudsonPrivateSecurityRealm

def realm = Jenkins.instance.securityRealm as HudsonPrivateSecurityRealm

// Create the user with a temporary password — they should change it on first login
def user = realm.createAccount('contractor-raj', 'ChangeMe123!')
user.setFullName('Raj Patel (Contractor)')
user.save()

println "Created user: contractor-raj"
println "Full name:    Raj Patel (Contractor)"
println "Temporary password set — user should change on first login"
EOF