gitlab-branch-source-plugin: upgrading gitlab branch source to version 646 yields an error: Error while validating token: anonymous is missing the Overall/Administer permission

Jenkins and plugins versions report

Environment

Jenkins: 2.375.3 OS: Linux - 3.10.0-1160.76.1.el7.x86_64 Java: 11.0.17 - Red Hat, Inc. (OpenJDK 64-Bit Server VM)

Parameterized-Remote-Trigger:3.1.6.3 active-directory:2.30 additional-metrics:56.v426e1e69d12a_ agent-maintenance:1.76.v6396206d534f all-changes:1.5 allure-jenkins-plugin:2.30.3 analysis-model-api:10.23.1 ansible:148.v6b_13c6de3a_47 ansicolor:1.0.2 ant:481.v7b_09e538fcca antisamy-markup-formatter:155.v795fb_8702324 any-buildstep:14.ve115ec1484f0 apache-httpcomponents-client-4-api:4.5.14-150.v7a_b_9d17134a_5 artifact-repository-parameter:2.0.1 artifactdeployer:1.3 artifactory:3.18.0 assertthat-bdd-jira:1.7 atlassian-jira-software-cloud:2.0.7 authentication-tokens:1.4 authorize-project:1.4.0 autocancel:1.0.5 aws-credentials:191.vcb_f183ce58b_9 aws-java-sdk:1.12.406-370.v8f993c987059 aws-java-sdk-cloudformation:1.12.406-370.v8f993c987059 aws-java-sdk-codebuild:1.12.406-370.v8f993c987059 aws-java-sdk-ec2:1.12.406-370.v8f993c987059 aws-java-sdk-ecr:1.12.406-370.v8f993c987059 aws-java-sdk-ecs:1.12.406-370.v8f993c987059 aws-java-sdk-efs:1.12.406-370.v8f993c987059 aws-java-sdk-elasticbeanstalk:1.12.406-370.v8f993c987059 aws-java-sdk-iam:1.12.406-370.v8f993c987059 aws-java-sdk-logs:1.12.406-370.v8f993c987059 aws-java-sdk-minimal:1.12.406-370.v8f993c987059 aws-java-sdk-sns:1.12.406-370.v8f993c987059 aws-java-sdk-sqs:1.12.406-370.v8f993c987059 aws-java-sdk-ssm:1.12.406-370.v8f993c987059 badge:1.9.1 basic-branch-build-strategies:71.vc1421f89888e blueocean:1.27.2 blueocean-autofavorite:1.2.5 blueocean-bitbucket-pipeline:1.27.2 blueocean-commons:1.27.2 blueocean-config:1.27.2 blueocean-core-js:1.27.2 blueocean-dashboard:1.27.2 blueocean-display-url:2.4.1 blueocean-events:1.27.2 blueocean-git-pipeline:1.27.2 blueocean-github-pipeline:1.27.2 blueocean-i18n:1.27.2 blueocean-jira:1.27.2 blueocean-jwt:1.27.2 blueocean-personalization:1.27.2 blueocean-pipeline-api-impl:1.27.2 blueocean-pipeline-editor:1.27.2 blueocean-pipeline-scm-api:1.27.2 blueocean-rest:1.27.2 blueocean-rest-impl:1.27.2 blueocean-web:1.27.2 bootstrap4-api:4.6.0-5 bootstrap5-api:5.2.1-3 bouncycastle-api:2.27 branch-api:2.1071.v1a_188a_562481 build-environment:1.7 build-failure-analyzer:2.4.1 build-history-manager:1.6.0 build-history-metrics-plugin:97.vdcf3aa48af8d build-monitor-plugin:1.13+build.202205140447 build-name-setter:2.2.0 build-time-blame:64.vd8f4018a2bbe build-timeout:1.28 build-timestamp:1.0.3 build-user-vars-plugin:1.9 build-with-parameters:76.v9382db_f78962 buildtriggerbadge:251.vdf6ef853f3f5 built-on-column:1.3 caffeine-api:2.9.3-65.v6a_47d0f4d1fe calendar-view:0.3.2 checks-api:1.8.1 claim:516.v36293563731d clearcase:1.6.8 cloudbees-bitbucket-branch-source:796.v6cb_1559e1673 cloudbees-disk-usage-simple:178.v1a_4d2f6359a_8 cloudbees-folder:6.815.v0dd5a_cb_40e0e cloudbees-jenkins-advisor:336.v4d00382fe22c clover:4.13.0 cmakebuilder:4.1.1 cobertura:1.17 code-coverage-api:3.5.0 command-launcher:90.v669d7ccb_7c31 commons-httpclient3-api:3.1-3 commons-lang3-api:3.12.0-36.vd97de6465d5b_ commons-text-api:1.10.0-36.vc008c8fcda_7b_ compact-columns:1.169.v60b_7d496b_860 concurrent-step:1.0.0 conditional-buildstep:1.4.2 config-driven-pipeline:1.3 config-file-provider:3.11.1 configuration-as-code:1569.vb_72405b_80249 configuration-as-code-groovy:1.1 configurationslicing:430.v966357576543 confluence-publisher:136.vc30a_a_0d845d7 console-badge:1.1 console-column-plugin:197.vcf5a_ec1d7b_47 container-image-link:11.v2fee68a69c54 content-replace:1.7.0 conventional-commits:0.11.2 convert-to-pipeline:1.0 copyartifact:686.v6fd37018d7c2 cppcheck:1.26 credentials:1214.v1de940103927 credentials-binding:523.vd859a_4b_122e6 cucumber-reports:5.7.5 custom-build-properties:2.82.v16d5b_d3590c7 custom-folder-icon:2.3 custom-tools-plugin:0.8 customize-build-now:1.1 cvs:2.19.1 dark-theme:302.vf069cb_e01486 dashboard-view:2.472.v9ff2a_e6a_c529 data-tables-api:1.12.1-4 database:148.v4a_ff2ca_608b_7 database-mysql:1.4 database-postgresql:1.2 database-sqlite:1.3 date-parameter:0.0.4 declarative-pipeline-migration-assistant:1.5.5 declarative-pipeline-migration-assistant-api:1.5.5 deploy:1.16 describe-with-params:1.0 display-url-api:2.3.7 docker-build-publish:1.4.0 docker-commons:1.21 docker-compose-build-step:1.0 docker-custom-build-environment:1.7.3 docker-java-api:3.2.13-68.va_875df25a_b_45 docker-plugin:1.3.0 docker-workflow:563.vd5d2e5c4007f dockerhub-notification:2.6.3 dotnet-sdk:1.4.0 downstream-build-cache:1.7 dtkit-api:3.0.2 durable-task:504.vb10d1ae5ba2f echarts-api:5.4.0-1 editable-choice:60.v68c6aa7fa01e email-ext:2.94 email-ext-recipients-column:27.vb_9404db_b_018d emailext-template:1.5 embeddable-build-status:339.v1edb_5e63da_45 enhanced-metrics:1.6 enhanced-old-build-discarder:1.4 envinject-api:1.199.v3ce31253ed13 extended-choice-parameter:359.v35dcfdd0c20d extended-read-permission:3.2 extensible-choice-parameter:1.8.0 external-monitor-job:203.v683c09d993b_9 external-workspace-manager:1.2.3 extra-columns:1.25 extra-tool-installers:1.2 fail-the-build-plugin:5.v153b_2c826ef0 favorite:2.4.1 file-leak-detector:1.11 file-operations:1.11 file-parameters:264.v1733d9b_2a_380 files-found-trigger:1.5 filesystem-list-parameter-plugin:0.0.8 flexible-publish:0.16.1 folder-properties:1.2.1 font-awesome-api:6.2.1-1 forensics-api:1.17.0 fstrigger:1.00 generic-event:40.v080de468d609 generic-webhook-trigger:1.86.2 git:5.0.0 git-automerger:0.6.3 git-changelog:3.28 git-chooser-alternative:1.1 git-client:4.1.0 git-forensics:1.11.0 git-parameter:0.9.18 git-push:34.vd474e0fe7b_ec git-server:99.va_0826a_b_cdfa_d git-tag-message:1.7.1 git-userContent:1.4 github:1.37.0 github-api:1.303-400.v35c2d8258028 github-branch-source:1701.v00cc8184df93 github-checks:1.0.19 github-pr-comment-build:86.v23ae6d00ab99 github-pr-coverage-status:2.2.0 github-pullrequest:0.5.0 gitlab-api:5.0.1-78.v47a_45b_9f78b_7 gitlab-branch-source:645.v62a_b_6fce8659 gitlab-logo:1.1.0 gitlab-merge-request-jenkins:2.0.0 gitlab-plugin:1.7.7 google-oauth-plugin:1.0.7 gradle:2.3 groovy:453.vcdb_a_c5c99890 groovy-postbuild:2.5 grypescanner:1.4 h2-api:1.4.199 handy-uri-templates-2-api:2.1.8-22.v77d5b_75e6953 hp-application-automation-tools-plugin:7.7 htmlpublisher:1.31 http_request:1.16 hudson-wsclean-plugin:1.0.8 image-tag-parameter:2.0 inline-pipeline:1.0.2 inodes-monitor:0.5.1 instance-identity:142.v04572ca_5b_265 ionicons-api:31.v4757b_6987003 ivy:2.4 jackson2-api:2.14.2-319.v37853346a_229 jacoco:3.3.2 jakarta-activation-api:2.0.1-3 jakarta-mail-api:2.0.1-3 javadoc:226.v71211feb_e7e9 javax-activation-api:1.2.0-6 javax-mail-api:1.6.2-9 jaxb:2.3.8-1 jdk-tool:63.v62d2fd4b_4793 jenkins-design-language:1.27.2 jenkins-jira-plugin:4.0.0 jersey2-api:2.39-1 jfrog:1.0.5 jira:3.9 jira-ext:0.9 jira-steps:2.0.165.v8846cf59f3db jira-trigger:1.0.2 jjwt-api:0.11.5-77.v646c772fddb_0 jnr-posix-api:3.1.16-2 job-dsl:1.81 job-import-plugin:3.6 job-parameter-summary:0.5 job-restrictions:0.8 jobConfigHistory:1206.vc8967cc8a_2cb_ jobcacher:376.v1db_b_44565f7b_ jobtag:25.va_12b_1dd63367 jquery:1.12.4-1 jquery3-api:3.6.1-2 jsch:0.1.55.61.va_e9ee26616e7 junit:1177.v90374a_ef4d09 junit-attachments:131.vef2117770555 junit-realtime-test-reporter:90.v7dc2c937f9a_8 kerberos-sso:1.11 kotlin-v1-stdlib-jdk8:1.3.20-1.4 kubernetes:3893.v73d36f3b_9103 kubernetes-cli:1.12.0 kubernetes-client-api:6.4.1-215.v2ed17097a_8e9 kubernetes-credentials:0.10.0 last-changes:2.7.11 ldap:659.v8ca_b_a_fe79fa_d leastload:3.0.0 list-git-branches-parameter:0.0.13 locale:226.v008e1b_58cb_b_0 lockable-resources:1123.v4002ee23c671 log-parser:2.3.0 login-theme:1.1 m2release:0.16.3 mail-watcher-plugin:1.18 mailer:448.v5b_97805e3767 managed-scripts:1.5.6 mapdb-api:1.0.9-28.vf251ce40855d mask-passwords:150.vf80d33113e80 matlab:2.9.0 matrix-auth:3.1.6 matrix-combinations-parameter:1.3.2 matrix-project:785.v06b_7f47b_c631 maven-dependency-update-trigger:1.5 maven-info:0.3.1 maven-plugin:3.21 maven-snapshot-check:186.v844b_fed00d1b metrics:4.2.13-420.vea_2f17932dd6 mina-sshd-api-common:2.9.2-50.va_0e1f42659a_a mina-sshd-api-core:2.9.2-50.va_0e1f42659a_a miniorange-saml-sp:2.0.1 monitoring:1.92.0 msbuild:1.30 mstest:1.0.0 mstestrunner:1.5.0 multi-module-tests-publisher:1.44 multibranch-action-triggers:1.8.6 multibranch-build-strategy-extension:1.0.10 multibranch-scan-webhook-trigger:1.0.9 multiselect-parameter:1.4 muuri-api:0.9.5-3 naginator:1.18.2 nant:248.vcc8a_3eec8db_a next-build-number:1.8 next-executions:1.0.15 node-iterator-api:49.v58a_8b_35f8363 nodejs:1.6.0 nodelabelparameter:1.11.0 notification:1.15 notify-events:1.6.2 npm-yarn-wrapper-steps:0.4.0 nuget:1.1 nunit:0.28 oauth-credentials:0.5 okhttp-api:4.10.0-125.v3593b_a_f8c97b_ ownership:0.13.0 pam-auth:1.10 parameterized-scheduler:1.2 parameterized-trigger:2.45 percentage-du-node-column:0.1.0 pipeline-aggregator-view:1.15 pipeline-build-step:486.vd08f550cceee pipeline-config-history:1.6 pipeline-cps-http:0.3.1 pipeline-github:2.8-138.d766e30bb08b pipeline-github-lib:38.v445716ea_edda_ pipeline-githubnotify-step:49.vf37bf92d2bc8 pipeline-graph-analysis:202.va_d268e64deb_3 pipeline-graph-view:163.v84cf2343b_266 pipeline-groovy-lib:629.vb_5627b_ee2104 pipeline-input-notification:15.v175f12f20f9e pipeline-input-step:466.v6d0a_5df34f81 pipeline-maven:1257.v89e586d3c58c pipeline-milestone-step:111.v449306f708b_7 pipeline-model-api:2.2118.v31fd5b_9944b_5 pipeline-model-definition:2.2118.v31fd5b_9944b_5 pipeline-model-extensions:2.2118.v31fd5b_9944b_5 pipeline-multibranch-defaults:2.1 pipeline-npm:23.ve3416e2f5249 pipeline-project-env:88.v121b_f0c9059a pipeline-rest-api:2.31 pipeline-stage-step:305.ve96d0205c1c6 pipeline-stage-tags-metadata:2.2118.v31fd5b_9944b_5 pipeline-stage-view:2.31 pipeline-timeline:1.0.3 pipeline-utility-steps:2.15.1 plain-credentials:143.v1b_df8b_d3b_e48 platformlabeler:1834.v30a_0cdf167e7 plugin-usage-plugin:4.0 plugin-util-api:2.20.0 pollscm:1.3.1 popper-api:1.16.1-3 popper2-api:2.11.6-2 postbuild-task:1.9 postbuildscript:3.2.0-460.va_fda_0fa_26720 powershell:2.0 preSCMbuildstep:44.v6ef4fd97f56e prism-api:1.29.0-2 prometheus:2.1.1 promoted-builds:892.vd6219fc0a_efb publish-over:0.22 publish-over-cifs:0.16 publish-over-ftp:1.17 pubsub-light:1.17 purge-job-history:1.6 pyenv-pipeline:2.1.2 python:1.3 rabbitmq-build-trigger:2.5 rabbitmq-consumer:2.8 rabbitmq-publisher:1.3.1 rebuild:1.34 remote-file:1.23 repository-connector:2.2.0 resource-disposer:0.21 rest-list-parameter:1.6.3 rich-text-publisher-plugin:1.4 run-condition:1.5 run-selector:1.1.1 saml:4.385.v4dea_91565e9d schedule-build:422.v5340de213c7e scm-api:631.v9143df5b_e4a_a scm-filter-branch-pr:0.5.1 script-security:1229.v4880b_b_e905a_6 scriptler:3.5 select2-api:4.0.13-8 seleniumhtmlreport:1.1 semantic-versioning-plugin:1.15 shelve-project-plugin:3.2 sidebar-link:2.2.1 sidebar-update-notification:1.1.0 simple-theme-plugin:146.v0e67db_a_9052e snakeyaml-api:1.33-95.va_b_a_e3e47b_fa_4 sonar:2.15 sse-gateway:1.26 ssh:2.6.1 ssh-agent:295.v9ca_a_1c7cc3a_a_ ssh-credentials:305.v8f4381501156 ssh-slaves:2.854.v7fd446b_337c9 ssh-steps:2.0.65.vd26b_5b_9b_de4d sshd:3.275.v9e17c10f2571 startup-trigger-plugin:2.9.3 strict-crumb-issuer:2.1.0 structs:324.va_f5d6774f3a_d subversion:2.17.1 support-core:1262.vc248605ec68b swarm:3.39 synopsys-coverity:3.0.3 terraform:1.0.10 test-results-aggregator:1.2.11 test-results-analyzer:0.4.0 text-finder:1.22 theme-manager:1.6 thinBackup:1.15 timestamper:1.22 token-macro:321.vd7cc1f2a_52c8 tracking-git:1.0 trilead-api:2.84.v72119de229b_7 uno-choice:2.6.4 urltrigger:1.02 validating-string-parameter:2.8 validating-yaml-parameter:89.vf13c6b_f41036 variant:59.vf075fe829ccb versioncolumn:95.v82f3985cd6e1 versionnumber:1.10 view-job-filters:2.3 vstestrunner:1.0.8 warnings-ng:9.23.1 webhook-step:173.vfa_b_93560b_977 windows-cloud:1.0.1 wix:1.12 workflow-aggregator:590.v6a_d052e5a_a_b_5 workflow-api:1208.v0cc7c6e0da_9e workflow-basic-steps:1010.vf7a_b_98e847c1 workflow-cps:3624.v43b_a_38b_62b_b_7 workflow-durable-task-step:1234.v019404b_3832a workflow-job:1282.ve6d865025906 workflow-multibranch:733.v109046189126 workflow-remote-loader:1.5 workflow-scm-step:400.v6b_89a_1317c9a_ workflow-step-api:639.v6eca_cd8c04a_a_ workflow-support:839.v35e2736cfd5c ws-cleanup:0.44 xtrigger-api:1.0 xunit:3.1.2 yet-another-build-visualizer:1.16 zentimestamp:4.2

What Operating System are you using (both controller, and any agents involved in the problem)?

linux, centos, version is not relevant to the issue. no agent is involved.

Reproduction steps

  1. install gitlab branch source plugin version 645.
  2. setup a gitlab server and connection .
  3. create a multibranch pipeline to any repo, using the gitlab branch source plugin.
  4. set the job to run on any push to the repo.
  5. add a Jenkinsfile to the repo in gitlab, make it simple like println "hello world"
  6. make sure you are able to run the job manually, and trigger it automatically when a push is made to the repo.
  7. update the gitlab branch source plugin to 646.
  8. push something the branch containing the Jenkinsfile.

Expected Results

jenkins job of the branch with the new push should run automatically.

Actual Results

job doesn’t run. warning appears in the jenkins controller log file:

WARNING i.j.p.g.GitLabSystemHookAction#isValidToken: Error while validating token: anonymous is missing the Overall/Administer permission

Anything else?

  1. entire error from log file is attached.
  2. downgrading to gitlab branch source 645 solves the issue. gitlab-branch-source-problem-646.txt

About this issue

  • Original URL
  • State: closed
  • Created a year ago
  • Reactions: 17
  • Comments: 20 (5 by maintainers)

Most upvoted comments

Same problem here. Going to downgrade back to a working version.

Problem is likely caused by https://github.com/jenkinsci/gitlab-branch-source-plugin/blob/b9560d64b69f2e2b3ecc334a9f4ac463b0c26013/src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java#L377 however I can’t tell that I’m 100% sure because the stacktrace is due to some reason cut away in https://github.com/jenkinsci/gitlab-branch-source-plugin/blob/b9560d64b69f2e2b3ecc334a9f4ac463b0c26013/src/main/java/io/jenkins/plugins/gitlabbranchsource/GitLabWebHookAction.java#L94

Also note that there’s now a new method that also contains permission checks, however it looks unused: https://github.com/jenkinsci/gitlab-branch-source-plugin/blob/b9560d64b69f2e2b3ecc334a9f4ac463b0c26013/src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java#L327-L360

+1
AB-xdev on Mar 10, 2023

same error here, all our jenkins are configured with Config-as-Code and were impacted by the issue 😦

The rollback consisting in :

  • downgrade the plugin to the previous version (gitlab-branch-source:646.vb_9560d64b_69f to gitlab-branch-source:644.va_a_66886e07b_5 in our case) in our plugins.txt file
  • put back the old conf in our configuration-as-code gitlab section
unclassified:
  gitLabServers:
    servers:              
      - name: "gitlab"
        serverUrl: "https://{{ gitlab_hostname }}"
        credentialsId: "{{ gitlab_jenkins_access_token_credentials_id }}"
        webhookSecretCredentialsId: "gitlab-jenkins-api-read-token"
        manageWebHooks: true
        manageSystemHooks: false

to

unclassified:
  gitLabServers:
    servers:              
      - name: "gitlab"
        serverUrl: "https://{{ gitlab_hostname }}"
        credentialsId: "{{ gitlab_jenkins_access_token_credentials_id }}"
        secretToken: "{XXXYYYZZZ=}"
        manageWebHooks: true
        manageSystemHooks: false

seems to work for now (we had to scan some gitlab groups in jenkins to reconfigure the webhooks in gitlab)

+1
yogeek on Mar 9, 2023

@t0rb3n this is related 😉

+1
bguerin on Mar 7, 2023

Not sure if this and the bug I am experiencing are related but after the update to 646 the webhooks in GitLab are failing with HTTP Error 401.

+1
t0rb3n on Mar 7, 2023

I’m looking into it.

+1
fredg02 on Mar 6, 2023
Read more comments on GitHub
← gitlab-branch-source-plugin: No longer works without secret token
hashicorp-vault-plugin: Access denied to Vault Secrets at 'path/to/secret' →