the Jenkins master. This makes it easier to manage firewall rules allowing JNLP-based agents to connect to the master. 

## Access Control 

Access Control is the primary mechanism for securing a Jenkins environment against unauthorized usage. Two facets of configuration are necessary for configuring Access Control in Jenkins: 

1. A Security Realm  which informs the Jenkins environment how and where to pull user (or identity) information from. Also commonly known as "authentication." 

2. Authorization  configuration which informs the Jenkins environment as to which users and/or groups can access which aspects of Jenkins, and to what extent. 

Using both the Security Realm and Authorization configurations it is possible to configure very relaxed or very rigid authentication and authorization schemes in Jenkins. 

Additionally, some plugins such as the plugin:role-strategy[Role-based Authorization Strategy] plugin can extend the Access Control capabilities of Jenkins to support even more nuanced authentication and authorization schemes. 

## Security Realm 

By default Jenkins includes support for a few different Security Realms: 

## Delegate to servlet container 

For delegating authentication a servlet container running the Jenkins master, such as Jetty. If using this option, please consult the servlet container’s authentication documentation. 

## Jenkins’ own user database 

Use Jenkins’s own built-in user data store for authentication instead of delegating to an external system. This is enabled by default with new Jenkins 2.0 or later installations and is suitable for smaller environments. 

## LDAP 

Delegate all authentication to a configured LDAP server, including both users and groups. This option is more common for larger installations in organizations which already have configured an external identity provider such as LDAP. This also supports Active Directory installations. 

## NOTE 

## Unix user/group database 

This feature is provided by the plugin:ldap[LDAP plugin] that may not be installed on your instance. 

Delegates the authentication to the underlying Unix OS-level user database on the Jenkins master. This mode will also allow re-use of Unix groups for authorization. For example, Jenkins can be configured such that "Everyone in the developers  group has administrator access." To support this feature, Jenkins relies on PAM which may need to be configured external to the Jenkins environment. 

