[JIRA] Created: (JENKINS-9774) Enabling "Project Matrix Authorization Strategy" without checking any permissions causes config.xml parsing to fail

david@davidstrauss.net (JIRA)

unread,

May 26, 2011, 2:11:03 PM5/26/11

to jenkinsc...@googlegroups.com

Enabling "Project Matrix Authorization Strategy" without checking any permissions causes config.xml parsing to fail
-------------------------------------------------------------------------------------------------------------------

Key: JENKINS-9774
URL: https://issues.jenkins-ci.org/browse/JENKINS-9774
Project: Jenkins
Issue Type: Bug
Components: core, security
Affects Versions: current
Reporter: davidstrauss

The config.xml:
<?xml version='1.0' encoding='UTF-8'?>
<hudson>
<version>1.413</version>
<numExecutors>2</numExecutors>
<mode>NORMAL</mode>
<useSecurity>true</useSecurity>
<authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy" /> 
<securityRealm class="hudson.security.HudsonPrivateSecurityRealm">
<disableSignup>false</disableSignup>
</securityRealm>
<markupFormatter class="hudson.markup.RawHtmlMarkupFormatter"/>
[...snip...]

The backtrace on startup:
org.jvnet.hudson.reactor.ReactorException: hudson.util.IOException2: Unable to read /var/lib/jenkins/config.xml
at org.jvnet.hudson.reactor.Reactor.execute(Reactor.java:246)
at hudson.model.Hudson.executeReactor(Hudson.java:753)
at hudson.model.Hudson.<init>(Hudson.java:667)
at hudson.model.Hudson.<init>(Hudson.java:607)
at hudson.WebAppMain$2.run(WebAppMain.java:215)
Caused by: hudson.util.IOException2: Unable to read /var/lib/jenkins/config.xml
at hudson.XmlFile.unmarshal(XmlFile.java:152)
at hudson.model.Hudson$12.run(Hudson.java:2340)
at org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:146)
at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:259)
at hudson.model.Hudson$4.runTask(Hudson.java:735)
at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:187)
at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:94)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
at java.lang.Thread.run(Thread.java:636)
Caused by: com.thoughtworks.xstream.converters.ConversionException: only START_TAG can have attributes END_TAG seen ...tegy class="hudson.security.ProjectMatrixAuthorizationStrategy" />... @7:87 : only START_TAG can have attributes END_TAG seen ...tegy class="hudson.security.ProjectMatrixAuthorizationStrategy" />... @7:87
---- Debugging information ----
message : only START_TAG can have attributes END_TAG seen ...tegy class="hudson.security.ProjectMatrixAuthorizationStrategy" />... @7:87
cause-exception : java.lang.IndexOutOfBoundsException
cause-message : only START_TAG can have attributes END_TAG seen ...tegy class="hudson.security.ProjectMatrixAuthorizationStrategy" />... @7:87
class : hudson.model.Hudson
required-type : hudson.security.ProjectMatrixAuthorizationStrategy
path : /hudson/authorizationStrategy
line number : 7
-------------------------------
at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:89)
at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:63)
at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:76)
at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:60)
at hudson.util.RobustReflectionConverter.unmarshalField(RobustReflectionConverter.java:290)
at hudson.util.RobustReflectionConverter.doUnmarshal(RobustReflectionConverter.java:233)
at hudson.util.RobustReflectionConverter.unmarshal(RobustReflectionConverter.java:180)
at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:82)
at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:63)
at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:76)
at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:60)
at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:137)
at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:33)
at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:926)
at hudson.util.XStream2.unmarshal(XStream2.java:80)
at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:912)
at hudson.XmlFile.unmarshal(XmlFile.java:148)
... 9 more
Caused by: java.lang.IndexOutOfBoundsException: only START_TAG can have attributes END_TAG seen ...tegy class="hudson.security.ProjectMatrixAuthorizationStrategy" />... @7:87
at org.xmlpull.mxp1.MXParser.getAttributeValue(MXParser.java:927)
at com.thoughtworks.xstream.io.xml.XppReader.getAttribute(XppReader.java:93)
at com.thoughtworks.xstream.io.ReaderWrapper.getAttribute(ReaderWrapper.java:56)
at hudson.util.RobustReflectionConverter.instantiateNewInstance(RobustReflectionConverter.java:324)
at hudson.util.RobustReflectionConverter.unmarshal(RobustReflectionConverter.java:179)
at hudson.security.ProjectMatrixAuthorizationStrategy$ConverterImpl.unmarshal(ProjectMatrixAuthorizationStrategy.java:119)
at hudson.util.XStream2$AssociatedConverterImpl.unmarshal(XStream2.java:224)
at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:82)
... 25 more

--
This message is automatically generated by JIRA.
-
For more information on JIRA, see: http://www.atlassian.com/software/jira

melvin.bautista@arkipel.net (JIRA)

unread,

Jun 20, 2012, 4:52:23 AM6/20/12

to jenkinsc...@googlegroups.com

melvin bautista commented on

JENKINS-9774

Enabling "Project Matrix Authorization Strategy" without checking any permissions causes config.xml parsing to fail

same issue here. i think you must remove the jenkins to your server or unisntall jenkins then install it again. )

This message is automatically generated by JIRA.

If you think it was sent incorrectly, please contact your JIRA administrators.

daniel@beckweb.net (JIRA)

unread,

Sep 1, 2014, 6:51:01 PM9/1/14

to jenkinsc...@googlegroups.com

Daniel Beck commented on

JENKINS-9774

Enabling "Project Matrix Authorization Strategy" without checking any permissions causes config.xml parsing to fail

What exactly is the desired behavior here? That Jenkins does not even accept the new configuration when you save it? Because you will lock yourself and everyone else out.

This message is automatically generated by JIRA.

If you think it was sent incorrectly, please contact your JIRA administrators.

daniel@beckweb.net (JIRA)

unread,

Sep 22, 2014, 4:53:24 PM9/22/14

to jenkinsc...@googlegroups.com

Daniel Beck commented on

JENKINS-9774

Enabling "Project Matrix Authorization Strategy" without checking any permissions causes config.xml parsing to fail

This message is automatically generated by JIRA.

If you think it was sent incorrectly, please contact your JIRA administrators.

mickael@coandplay.com (JIRA)

unread,

Oct 6, 2014, 12:24:19 AM10/6/14

to jenkinsc...@googlegroups.com

Mickael Ange commented on

JENKINS-9774

Enabling "Project Matrix Authorization Strategy" without checking any permissions causes config.xml parsing to fail

Hi,

I have 2 Jenkins instances in testing (1.565.3) with a unique administrator account for username mickael. I configured "Project-based Matrix Authorization Strategy" on both and I don't know why (maybe my bad during the process), one instance failed to restart after installing thinBackup plugin from CLI.

Oct 06, 2014 11:50:16 AM hudson.util.BootFailure publish
SEVERE: Failed to initialize Jenkins
hudson.util.HudsonFailedToLoad: org.jvnet.hudson.reactor.ReactorException: java.io.IOException: Unable to read /var/lib/jenkins/config.xml
	at hudson.WebAppMain$3.run(WebAppMain.java:234)
Caused by: org.jvnet.hudson.reactor.ReactorException: java.io.IOException: Unable to read /var/lib/jenkins/config.xml
	at org.jvnet.hudson.reactor.Reactor.execute(Reactor.java:269)
	at jenkins.InitReactorRunner.run(InitReactorRunner.java:44)
	at jenkins.model.Jenkins.executeReactor(Jenkins.java:916)
	at jenkins.model.Jenkins.<init>(Jenkins.java:815)
	at hudson.model.Hudson.<init>(Hudson.java:82)
	at hudson.model.Hudson.<init>(Hudson.java:78)
	at hudson.WebAppMain$3.run(WebAppMain.java:222)
Caused by: java.io.IOException: Unable to read /var/lib/jenkins/config.xml
	at hudson.XmlFile.unmarshal(XmlFile.java:165)
	at jenkins.model.Jenkins$17.run(Jenkins.java:2565)
	at org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:169)
	at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:282)
	at jenkins.model.Jenkins$7.runTask(Jenkins.java:905)
	at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:210)
	at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:117)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at java.lang.Thread.run(Thread.java:745)
Caused by: com.thoughtworks.xstream.converters.ConversionException: only START_TAG can have attributes END_TAG seen ...ategy class="hudson.security.ProjectMatrixAuthorizationStrategy"/>... @8:86 : only START_TAG can have attributes END_TAG seen ...ategy class="hudson.security.ProjectMatrixAuthorizationStrategy"/>... @8:86
---- Debugging information ----
message             : only START_TAG can have attributes END_TAG seen ...ategy class="hudson.security.ProjectMatrixAuthorizationStrategy"/>... @8:86
cause-exception     : java.lang.IndexOutOfBoundsException
cause-message       : only START_TAG can have attributes END_TAG seen ...ategy class="hudson.security.ProjectMatrixAuthorizationStrategy"/>... @8:86
class               : hudson.security.ProjectMatrixAuthorizationStrategy
required-type       : hudson.security.ProjectMatrixAuthorizationStrategy
converter-type      : hudson.util.XStream2$AssociatedConverterImpl
path                : /hudson/authorizationStrategy
line number         : 8
class[1]            : hudson.model.Hudson
converter-type[1]   : hudson.util.RobustReflectionConverter
version             : not available
-------------------------------
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:79)
	at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:65)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
	at hudson.util.RobustReflectionConverter.unmarshalField(RobustReflectionConverter.java:349)
	at hudson.util.RobustReflectionConverter.doUnmarshal(RobustReflectionConverter.java:289)
	at hudson.util.RobustReflectionConverter.unmarshal(RobustReflectionConverter.java:228)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
	at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:65)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:50)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:134)
	at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)
	at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1189)
	at hudson.util.XStream2.unmarshal(XStream2.java:113)
	at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1173)
	at hudson.XmlFile.unmarshal(XmlFile.java:163)
	... 9 more
Caused by: java.lang.IndexOutOfBoundsException: only START_TAG can have attributes END_TAG seen ...ategy class="hudson.security.ProjectMatrixAuthorizationStrategy"/>... @8:86
	at org.xmlpull.mxp1.MXParser.getAttributeValue(MXParser.java:927)
	at com.thoughtworks.xstream.io.xml.XppReader.getAttribute(XppReader.java:139)
	at com.thoughtworks.xstream.io.ReaderWrapper.getAttribute(ReaderWrapper.java:52)
	at hudson.util.RobustReflectionConverter.instantiateNewInstance(RobustReflectionConverter.java:383)
	at hudson.util.RobustReflectionConverter.unmarshal(RobustReflectionConverter.java:227)
	at hudson.security.ProjectMatrixAuthorizationStrategy$ConverterImpl.unmarshal(ProjectMatrixAuthorizationStrategy.java:120)
	at hudson.util.XStream2$AssociatedConverterImpl.unmarshal(XStream2.java:362)
	at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
	... 24 more

I managed to fix the problem by comparing both instance config.xml.

Failing config.xml, instance 1

<?xml version='1.0' encoding='UTF-8'?>
<hudson>
  <disabledAdministrativeMonitors/>
  <version>1.0</version>
  <numExecutors>2</numExecutors>
  <mode>NORMAL</mode>
  <useSecurity>true</useSecurity>
  <authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy"/>
  <securityRealm class="hudson.security.HudsonPrivateSecurityRealm">
    <disableSignup>true</disableSignup>
    <enableCaptcha>false</enableCaptcha>
  </securityRealm>
  <disableRememberMe>false</disableRememberMe>
  <projectNamingStrategy class="jenkins.model.ProjectNamingStrategy$DefaultProjectNamingStrategy"/>
  <workspaceDir>${ITEM_ROOTDIR}/workspace</workspaceDir>
  <buildsDir>${ITEM_ROOTDIR}/builds</buildsDir>
  <markupFormatter class="hudson.markup.EscapedMarkupFormatter"/>
  <jdks/>
  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
  <myViewsTabBar class="hudson.views.DefaultMyViewsTabBar"/>
  <clouds/>
  <slaves/>
  <scmCheckoutRetryCount>0</scmCheckoutRetryCount>
  <views>
    <hudson.model.AllView>
      <owner class="hudson" reference="../../.."/>
      <name>All</name>
      <filterExecutors>false</filterExecutors>
      <filterQueue>false</filterQueue>
      <properties class="hudson.model.View$PropertyList"/>
    </hudson.model.AllView>
  </views>
  <primaryView>All</primaryView>
  <slaveAgentPort>0</slaveAgentPort>
  <label></label>
  <nodeProperties/>
  <globalNodeProperties/>
</hudson>

Working config.xml, instance 2

<?xml version='1.0' encoding='UTF-8'?>
<hudson>
  <disabledAdministrativeMonitors>
    <string>jenkins.security.RekeySecretAdminMonitor</string>
  </disabledAdministrativeMonitors>
  <version>1.565.3</version>
  <numExecutors>2</numExecutors>
  <mode>NORMAL</mode>
  <useSecurity>true</useSecurity>
  <authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy">
    <permission>hudson.model.Hudson.Administer:mickael</permission>
  </authorizationStrategy>
  <securityRealm class="hudson.security.HudsonPrivateSecurityRealm">
    <disableSignup>true</disableSignup>
    <enableCaptcha>false</enableCaptcha>
  </securityRealm>
  <disableRememberMe>false</disableRememberMe>
  <projectNamingStrategy class="jenkins.model.ProjectNamingStrategy$DefaultProjectNamingStrategy"/>
  <workspaceDir>${ITEM_ROOTDIR}/workspace</workspaceDir>
  <buildsDir>${ITEM_ROOTDIR}/builds</buildsDir>
  <markupFormatter class="hudson.markup.EscapedMarkupFormatter"/>
  <jdks/>
  <viewsTabBar class="hudson.views.DefaultViewsTabBar"/>
  <myViewsTabBar class="hudson.views.DefaultMyViewsTabBar"/>
  <clouds/>
  <slaves/>
  <quietPeriod>5</quietPeriod>
  <scmCheckoutRetryCount>0</scmCheckoutRetryCount>
  <views>
    <hudson.model.AllView>
      <owner class="hudson" reference="../../.."/>
      <name>All</name>
      <filterExecutors>false</filterExecutors>
      <filterQueue>false</filterQueue>
      <properties class="hudson.model.View$PropertyList"/>
    </hudson.model.AllView>
  </views>
  <primaryView>All</primaryView>
  <slaveAgentPort>0</slaveAgentPort>
  <label></label>
  <nodeProperties/>
  <globalNodeProperties/>
</hudson>

The main difference is on <authorizationStrategy> tag.

If I edited /var/lib/jenkins/config.xml and replaced

<authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy"/>

by

<authorizationStrategy class="hudson.security.ProjectMatrixAuthorizationStrategy">
    <permission>hudson.model.Hudson.Administer:mickael</permission>
  </authorizationStrategy>

then, after restarting the instance, Jenkins is back to work.

Cheers,

This message is automatically generated by JIRA.

If you think it was sent incorrectly, please contact your JIRA administrators.

o.v.nenashev@gmail.com (JIRA)

unread,

Oct 8, 2014, 1:49:19 AM10/8/14

to jenkinsc...@googlegroups.com

Oleg Nenashev updated

JENKINS-9774

Enabling "Project Matrix Authorization Strategy" without checking any permissions causes config.xml parsing to fail

Change By:	Oleg Nenashev (08/Oct/14 5:48 AM)
Component/s:	matrix-auth
Component/s:	security
Component/s:	core