Answers: <p>If you're running this code today via script console, you're probably running into a RejectedAccessException from the sandbox which is why you require admin access to run this coupled with and or needing administrator access to use the script console.</p>
  
  <p>If you put this code into a <a href="https://jenkins.io/doc/book/pipeline/shared-libraries/" rel="nofollow noreferrer">shared library</a>, the code becomes trusted, and you no longer require administrator access to run the code and you no longer need script console. You just need a job that can call the shared library, if needed you can restrict access to the folder or job.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-02T15:57:11.020Z
Answers: 2019-08-02T15:57:11.020Z
Answers: casey vega
Body: <p>We have been using groovy script to read the build queue state:</p>
  
  <pre><code>def builder = new groovy.json.JsonBuilder()
  
  builder {
    queueItems(Jenkins.instance.queue.items.collect { obj -&gt;
        [
          id: obj.id,
          name: obj.task.name,
          isStuck: obj.stuck,
          isBlocked: obj.blocked,
          isDisabled: obj.task.disabled,
          inQueueSince: obj.inQueueSince,
          why: obj.why,
          causesDescription: obj.causesDescription,
          queueItemUrl: obj.url,
          taskUrl: obj.task.url
        ]
     })
  }
  
  println builder.toPrettyString()
  </code></pre>
  
  <p>Then we add <a href="https://plugins.jenkins.io/azure-ad" rel="nofollow noreferrer">Azure AD plugin</a>. It requires an account with the <code>hudson.model.Hudson.Administer</code> permission to run a script.</p>
  
  <p>We use a tech account, but the problem is that everyone can logon interactively using this login and became Jenkins admin.</p>
  
  <p>Is it possible to have this account enabled, but restrict interactive logon to Jenkins?</p>
  
Tags: <jenkins><security>
Title: Restrict user logon in Jenkins
UserDisplayName: Skyblade
ThreadText: # Restrict user logon in Jenkins
  
  (Asked by: username_0 on 2019-08-02)
  
  We have been using groovy script to read the build queue state:
  
  ```
  def builder = new groovy.json.JsonBuilder()
  
  builder {
    queueItems(Jenkins.instance.queue.items.collect { obj ->
        [
          id: obj.id,
          name: obj.task.name,
          isStuck: obj.stuck,
          isBlocked: obj.blocked,
          isDisabled: obj.task.disabled,
          inQueueSince: obj.inQueueSince,
          why: obj.why,
          causesDescription: obj.causesDescription,
          queueItemUrl: obj.url,
          taskUrl: obj.task.url
        ]
     })
  }
  
  println builder.toPrettyString()
  
  ```
  
  Then we add [Azure AD plugin](https://plugins.jenkins.io/azure-ad). It requires an account with the `hudson.model.Hudson.Administer` permission to run a script.
  
  We use a tech account, but the problem is that everyone can logon interactively using this login and became Jenkins admin.
  
  Is it possible to have this account enabled, but restrict interactive logon to Jenkins?
  
  **Tags:** jenkins, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-08-02. Score: 1 | Accepted answer
  
  If you're running this code today via script console, you're probably running into a RejectedAccessException from the sandbox which is why you require admin access to run this coupled with and or needing administrator access to use the script console.
  
  If you put this code into a [shared library](https://jenkins.io/doc/book/pipeline/shared-libraries/), the code becomes trusted, and you no longer require administrator access to run the code and you no longer need script console. You just need a job that can call the shared library, if needed you can restrict access to the folder or job.
  
  
  ---
  
  