jenkins_user experimental password setting is broken

[jhoblitt]

I have been trying to get the jenkins_user experimental type to work with hudson.security.HudsonPrivateSecurityRealm under 1.641. I haven't yet determined if is an existing bug due to the combination of resources or a recent changes in jenkins. The cli jar returns java.io.EOFException errors as below until the "administrative" user's account is opened and then saved (without modification) in the WWW UI.

==> master: Error: Could not prefetch jenkins_num_executors provider 'cli': Execution of '/bin/java -jar /usr/lib/jenkins/jenkins-cli.jar -s http://localhost:8080 -i /usr/lib/jenkins/admin_private_key groovy /usr/lib/jenkins/puppet_helper.groovy get_num_executors' returned 255: java.io.EOFException
==> master:     at java.io.DataInputStream.readBoolean(DataInputStream.java:244)
==> master:     at hudson.cli.Connection.readBoolean(Connection.java:95)
==> master:     at hudson.cli.CLI.authenticate(CLI.java:573)
==> master:     at hudson.cli.CLI._main(CLI.java:484)
==> master:     at hudson.cli.CLI.main(CLI.java:390)

[jhoblitt]

I finally looked in the jenkins log and it appears that the password in not being set any longer.

Exception in thread "Thread-191" org.acegisecurity.userdetails.UsernameNotFoundException: Password is not set: admin

Opening the user in the WWW UI and saving it without any change sets the password to empty and the CLI jar starts working again.

[jhoblitt]

This problem does not occur if you set the password to be a plain text string rather than the hash form (#jbcrypt:...). This is a usable work around but it causes the type to be non-idempotent.

[cdenneen]

@jhoblitt I tried setting as suggested:

jenkins_user {'jadmin':
  password => 'changeme',
}

but still getting java.io.EOFException

[root@jenkins ~]# /bin/java -jar /usr/lib/jenkins/jenkins-cli.jar -s http://localhost:8080 -i /usr/lib/jenkins/admin_private_key groovy /usr/lib/jenkins/puppet_helper.groovy who_am_i
java.io.EOFException
        at java.io.DataInputStream.readBoolean(DataInputStream.java:244)
        at hudson.cli.Connection.readBoolean(Connection.java:95)
        at hudson.cli.CLI.authenticate(CLI.java:573)
        at hudson.cli.CLI._main(CLI.java:484)
        at hudson.cli.CLI.main(CLI.java:390)

What did you do to make this work around work?

[jhoblitt]

@cdenneen There is no method in puppet_helper.groovy named who_am_i, so your example command will always fail. A better test would be /bin/java -jar /usr/lib/jenkins/jenkins-cli.jar -s http://localhost:8080 -i /usr/lib/jenkins/admin_private_key who-am-i. If that sanity check fails, your jenkins installation is broken.

[cdenneen]

[vagrant@jenkins ~]$ /bin/java -jar /usr/lib/jenkins/jenkins-cli.jar -s http://localhost:8080 -i /usr/lib/jenkins/admin_private_key who-am-i
java.io.EOFException
        at java.io.DataInputStream.readBoolean(DataInputStream.java:244)
        at hudson.cli.Connection.readBoolean(Connection.java:95)
        at hudson.cli.CLI.authenticate(CLI.java:573)
        at hudson.cli.CLI._main(CLI.java:484)
        at hudson.cli.CLI.main(CLI.java:390)

So this would appear as if it's broken but can't imagine how since UI works just fine. Is there a way to DEBUG why this error is occuring?

[jhoblitt]

The master log sometimes has different information. I suggest you try to get a working jenkins installation with your desired authentication configuration before trying to puppetize it.

[jhoblitt]

I'm closing this since I assume it was resolved?