Authentication, Authorization, and Folder Roles

Scenario: A correct login is followed by an over-broad item regex that exposes another team's deployment job.

Pipeline example

// Overall/Read permits entry; folder Item permissions
// decide which jobs the identity may use.

Authentication and authorization differ

A security realm establishes identity through an IdP, LDAP, local users, or trusted proxy. Authorization grants permissions such as Overall Read or Administer, Item Read, Build, Configure and Delete, Run Replay, Workspace, Agent, View, and Credentials actions. Matrix authorization grants by principal; role strategies usually bind permission sets to regex-selected items. An authenticated person still needs only the actions required in their folder.

Regex details are security details. Anchor a team pattern and include descendants deliberately, such as ^team-a($|/.*), then test team-admin and nested jobs. Configure is code-execution authority because the user can alter Pipeline steps. Replay and trusted-library modification are similarly powerful. Overall Read allows entry but does not justify visibility into every item or credential.

Verify as a non-administrator

Administrators bypass ordinary denial paths, so use representative test identities. Attempt listing, reading configuration, triggering, configuring, replaying, viewing workspaces, binding folder credentials, and accessing a neighbor folder. Preserve an audited emergency administrator path with strong authentication rather than giving daily accounts broad rights.

When a proxy supplies identity headers, accept traffic only from known proxies, strip spoofed client headers, and block direct controller access. Review group membership and role assignment like code. A least-privilege rule should document why each permission exists and include a repeatable negative test showing that similarly named resources remain inaccessible.

Goal: Practice the concrete behavior in jenkins-credentials-binding. Learn sections have no Jenkins terminal; the Jenkins lab opens the real shared service in a new full-screen tab inside your private folder.