Jenkins: SAML, Okta, user groups, and Role-Based Security plugin
Tags: jenkins, security, sso, okta
Published: 2019-10-15 16:05:43

---
title: Jenkins: SAML, Okta, user groups, and Role-Based Security plugin
published: true
date: 2019-10-15 15:23:11 UTC
tags: Jenkins,Security,SSO,okta
canonical_url: https://rtfm.co.ua/en/jenkins-saml-okta-users-groups-and-role-based-security-plugin/
---

![](https://rtfm.co.ua/wp-content/uploads/2016/01/Jenkins.sh-600x600-e1453134979914.png)Still on the subject of the Okta and SSO for Jenkins – let’s configure a Role-Based Security plugin for our Jenkins. See the first part in the [Jenkins: SAML Authentication with Okta SSO and users groups](https://rtfm.co.ua/en/jenkins-saml-authentication-via-okta-and-users-groups/) post.

The general idea is to have user groups defined in the Okta, and Okta has to pass a user’s group when he will log in to the Jenkins.

Then Jenkins has to assign correct permissions for this user based on its group(s).

### The Role-Based Security plugin configuration

Install the [Role-based Authorization Strategy](https://plugins.jenkins.io/role-strategy) plugin itself:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124357.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124357.png)

Go to the _Configure Global Security_, switch the button to the _Role-Based Strategy_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124539.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124539.png)

Go to the _Manage and Assign Roles_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124648.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124648.png)

#### Create roles – global roles

Roles here are divided into three areas:

- _global roles_: obviously, global roles for global permissions, such as create/delete Views, Jobs, Overall
- _project roles_: the permission settings on a per-project basis – jobs are limited by a regular expression
- _agent roles_: Jenkins slaves/workers/agent permissions

If you’ll try to log in right now – will face with the “ **missing the Overall/Read permission** ” error:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_125226.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_125226.png)

To avoid it – we need to create a global role with the _Overall Read_ permissions.

Go to the _Manage Roles_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124808.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124808.png)

Create a new global role called _read_all_ and set permissions to the _Overall – Read_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124858.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124858.png)

Save.

#### Assign Roles

For example, let’s take a _Test_ user:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124955-1.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_124955-1.png)

It has two groups assigned – the _Everyone_ and the _DevOps_.

Go to the _Assign Roles_, add the _Everyone_ group and assign the _read_all_ to it:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_125119.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_125119.png)

Save and log in under this user:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_125439.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_125439.png)

Okay – you are able to log in, but can’t see any jobs right now.

#### Project roles

Next, need to create roles to grant access to various jobs/views.

For example, we have an _Android_ view with jobs for our Android-developers:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_125749-2.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_125749-2.png)

Go to the _Manage Roles_, add an _android_developer_ role and in the _Pattern_ set the `(?i)android_.*` value – here, with the `(?i)` we set to case-insensitive search and with the `android_.*` – will select all Android jobs:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_130215.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Security")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_130215.png)

You can click on a regex to see which jobs will match the filter you set in the _Pattern_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_131347.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Security")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_131347.png)

Go to the _Assign Roles_, attach the _android_developer_ role to the _Android_ group:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_130526.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_130526.png)

#### Okta Groups

Go to the Okta, add the _Android_ group to our test user:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_130418.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_130418.png)

Log in with this user:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_131509-1.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_131509-1.png)

Awesome – we are able to see only Android jobs and views.

In the same way let’s create another role – _ios_config_, for iOS, but this time – with the _Configure_ permissions:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_132824.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_132824.png)

Assign this role to the _iOS_ group:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_133008.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_133008.png)

In the Okta attach the _iOS_ group to the _Test user_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_132916.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_132916.png)

Log in and you’ll see iOS jobs now:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_133422-1.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_133422-1.png)

And the _Configure_ permission is working:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_133551-1.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Secuirty")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_133551-1.png)

### Backup

Security Realm, groups, and users which you created in the Jenkins will be saved in the `config.xml` file:

![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191015_134528.png "Jenkins: Okta, SAML, группы пользователей и Role-Based Security")

So it’s good practice to back up this file before changing any Security Real settings.

Done.

### Similar posts
 
- <small>10/11/2019</small> [Jenkins: SAML Authentication with Okta SSO and users groups](https://rtfm.co.ua/en/jenkins-saml-authentication-via-okta-and-users-groups/)   
- <small>09/30/2019</small> [Okta: SSO authentication for Gmail and Slack](https://rtfm.co.ua/en/okta-sso-authentication-for-gmail-and-slack/)