Body: <p>I need to securize nodes of Jenkins and allow them to be used only by one user.</p>
  <p>I read existing question : &quot;Jenkins - restrict which nodes can be selected by user when creating jobs&quot;</p>
  <p>but even using needed plugin :</p>
  <p>Project-based Matrix Authorization Strategy
  folder</p>
  <p>I don't succed to securize my node.</p>
  <p>1 - Project-based Matrix Authorization Strategy is selected in Authorization section
  one admin is create with all right. one standart user is created without administer rights and without agent rights.</p>
  <p>2 - Admin create one node
  3 - Admin securize the node using  : &quot;Enable node-based security&quot; option
  4 - only admin user is added in the table and all right are checked. standart user is not added in the table of security of the node.</p>
  <p>But then, standart user can create a job and select the &quot;protected&quot; node to be used for the job</p>
  <p>ps : option &quot;inheritance strategy&quot; of the node is configured as &quot;do not inherit permission grants from other ACLs&quot;</p>
  <p>Do I miss something ?</p>
  <p>please note that I'm using LDAP plugin and user are AD users. admin user is a user with number XXX and standart user is a user with number YYYY. These number are used in different matrix for right.</p>
  
Comments: CC BY-SA 4.0
Comments: 2021-08-19T14:06:58.980Z
Comments: I made some progress, I discover that build are executed by default by kind of "system" user then "node-based security" is useless because system user has all rights. So I need to install "authorize project". This last plugin allow user to force their job to be executed as "user" instead of "system" user. Then the node protection will be effective. But my problem is that this mode can be disabled (then system user will be used as usual) when the job is configured so it is not a real protection. The protected node could be still used by users that don't have the right.
Comments: iostrym
Comments: CC BY-SA 4.0
Comments: 2021-08-26T12:01:37.510Z
Comments: AFAIK there is still no good way to do it on the free version of Jenkins, which is why I didn't accept any answer.
Comments: bgdnlp
Comments: CC BY-SA 4.0
Comments: 2021-08-31T07:26:31.587Z
Comments: thanks, it seems to works on my side. drawback is the use of the deprecated plugin "authorize project", right ? but if I don't use pipelines then it will be ok, don't you think ? or will it be also some security problem if pipelines are used ? For instance securized node could be used by anyone if pipelines are used ?
Comments: iostrym
Tags: <jenkins><jenkins-plugins>
Title: Jenkins - restrict which nodes can be selected by user when creating jobs (already tried Project-based Matrix Authorization Strategy + folder plugins)
UserDisplayName: iostrym
ThreadText: # Jenkins - restrict which nodes can be selected by user when creating jobs (already tried Project-based Matrix Authorization Strategy + folder plugins)
  
  (Asked by: username_0 on 2021-08-19)
  
  I need to securize nodes of Jenkins and allow them to be used only by one user.
  
  I read existing question : "Jenkins - restrict which nodes can be selected by user when creating jobs"
  
  but even using needed plugin :
  
  Project-based Matrix Authorization Strategy
  folder
  
  I don't succed to securize my node.
  
  1 - Project-based Matrix Authorization Strategy is selected in Authorization section
  one admin is create with all right. one standart user is created without administer rights and without agent rights.
  
  2 - Admin create one node
  3 - Admin securize the node using : "Enable node-based security" option
  4 - only admin user is added in the table and all right are checked. standart user is not added in the table of security of the node.
  
  But then, standart user can create a job and select the "protected" node to be used for the job
  
  ps : option "inheritance strategy" of the node is configured as "do not inherit permission grants from other ACLs"
  
  Do I miss something ?
  
  please note that I'm using LDAP plugin and user are AD users. admin user is a user with number XXX and standart user is a user with number YYYY. These number are used in different matrix for right.
  
  **Tags:** jenkins, jenkins-plugins
  
  > **Comments:**
  > **username_0**: I made some progress, I discover that build are executed by default by kind of "system" user then "node-based security" is useless because system user has all rights. So I need to install "authorize project". This last plugin allow user to force their job to be executed as "user" instead of "system" user. Then the node protection will be effective. But my problem is that this mode can be disabled (then system user will be used as usual) when the job is configured so it is not a real protection. The protected node could be still used by users that don't have the right.  
  > **username_1**: AFAIK there is still no good way to do it on the free version of Jenkins, which is why I didn't accept any answer.  
  > **username_0**: thanks, it seems to works on my side. drawback is the use of the deprecated plugin "authorize project", right ? but if I don't use pipelines then it will be ok, don't you think ? or will it be also some security problem if pipelines are used ? For instance securized node could be used by anyone if pipelines are used ?  
  
  ---
  
  ## 0 answers
  
  