[JENKINS-73735] Add API to retrieve the agent secret #10354

kalindafab · 2025-02-27T19:01:08Z

https://issues.jenkins.io/browse/JENKINS-73735

This PR introduces a REST API to retrieve the agent secret required for remote agent launches. The previous approach of obtaining the secret via jnlpUrl was removed in PR 8773 and PR 677.

Currently, only administrators can retrieve the secret via a script, which makes it difficult for users with Agent Create or Agent Connect permissions to authenticate when using WebSockets.

This PR solves the issue by introducing an API that allows users with the required permissions to programmatically obtain the agent secret via a REST endpoint.

Testing done

Automated Tests:
Added unit tests for the new API to validate security restrictions and ensure only authorized users can access the secret.
Manual Testing:
Verified that a user with Agent Connect permission could retrieve the secret using the API.

Tested API endpoint using curl and Postman

Proposed changelog entries

Add a REST API to retrieve the secret required for agents.

Proposed changelog category

/label rfe

Proposed upgrade guidelines

N/A

Submitter checklist

The Jira issue, if it exists, is well-described.
The changelog entries and upgrade guidelines are appropriate for the audience affected by the change (users or developers, depending on the change) and are in the imperative mood (see examples). Fill in the Proposed upgrade guidelines section only if there are breaking changes or changes that may require extra steps from users during upgrade.
There is automated testing or an explanation as to why this change has no tests.
New public classes, fields, and methods are annotated with @Restricted or have @since TODO Javadocs, as appropriate.
New deprecations are annotated with @Deprecated(since = "TODO") or @Deprecated(forRemoval = true, since = "TODO"), if applicable.
New or substantially changed JavaScript is not defined inline and does not call eval to ease future introduction of Content Security Policy (CSP) directives (see documentation).
For dependency updates, there are links to external changelogs and, if possible, full differentials.
For new APIs and extension points, there is a link to at least one consumer.

Desired reviewers

@mention

Before the changes are marked as ready-for-merge:

Maintainer checklist

There are at least two (2) approvals for the pull request and no outstanding requests for change.
Conversations in the pull request are over, or it is explicit that a reviewer is not blocking the change.
Changelog entries in the pull request title and/or Proposed changelog entries are accurate, human-readable, and in the imperative mood.
Proper changelog labels are set so that the changelog can be generated automatically.
If the change needs additional upgrade steps from users, the upgrade-guide-needed label is set and there is a Proposed upgrade guidelines section in the pull request title (see example).
If it would make sense to backport the change to LTS, a Jira issue must exist, be a Bug or Improvement, and be labeled as lts-candidate to be considered (see query).

mawinter69 · 2025-02-27T19:14:20Z

core/src/test/java/jenkins/security/AgentSecretActionTest.java

This test should probably be in the test folder on the root of the project. This also avoids that you have to add a dependency to test-harness in code

mawinter69 · 2025-02-27T19:14:42Z

core/pom.xml

@@ -250,6 +250,12 @@ THE SOFTWARE.
      <groupId>org.connectbot</groupId>
      <artifactId>jbcrypt</artifactId>
    </dependency>
+    <dependency>


Why is this needed?
Also afaik we're already on jetty12

mawinter69 · 2025-02-27T19:15:12Z

core/pom.xml

@@ -471,6 +477,12 @@ THE SOFTWARE.
      <version>${xmlunit.version}</version>
      <scope>test</scope>
    </dependency>
+      <dependency>


should not be needed when the tests are moved to the right place

mawinter69 · 2025-02-27T19:15:35Z

core/src/main/java/hudson/console/AnnotatedLargeText.java

Change to that file are unrelated it seems. Please revert them

okay. The changes in that file are from a previous PR

mawinter69 · 2025-02-27T19:15:51Z

core/src/main/java/hudson/util/ChunkedInputStream.java

unrelated change, please revert

also this are from previous one

mawinter69 · 2025-02-27T19:16:37Z

core/src/main/java/hudson/model/Computer.java

@@ -1774,6 +1774,14 @@ public long getWhen() {
                    Permission.WRITE,
                    PermissionScope.COMPUTER);

+    public static final Permission AGENT_SECRET =


Do we really need a new permission? Isn't one of the existing permissions agent.connect or agent.configure sufficient?

you're right agent configure is sufficient

mawinter69 · 2025-02-27T19:18:22Z

core/src/main/java/jenkins/security/AgentSecretAction.java

+    }
+    public void doGet(StaplerRequest req, StaplerResponse rsp, @QueryParameter String nodeName) throws IOException {
+        Jenkins jenkins = Jenkins.get();
+        jenkins.checkPermission(Computer.AGENT_SECRET);


This permission check is wrong. You have to check the permission on the agent itself not in jenkins. A user might have the permission on one agent but not on another.

mawinter69 · 2025-02-27T19:19:20Z

core/src/main/java/jenkins/security/AgentSecretAction.java

I would have expected that the REST api is attached to the agent and not an unprotected rootaction

also such an action for an agent should only be attached when the agent is an inbound agent and not an outbound agent. Currently you could ask an ssh agent for the secret

mawinter69 · 2025-02-27T19:22:59Z

core/src/main/java/jenkins/security/AgentSecretAction.java

+    public String getIconFileName() {
+        return null;
+    }
+    public void doGet(StaplerRequest req, StaplerResponse rsp, @QueryParameter String nodeName) throws IOException {


Please use StaplerRequest2 and StaplerResponse2

…java" This reverts commit 8226879.

….java" This reverts commit 7881060fcbdc725a64164e8271d753d6be062856.

…java" This reverts commit 8226879.

kalindafab · 2025-03-01T07:33:31Z

Changed permission check from global Jenkins level to specific agent level
Uses existing CONNECT permission rather than creating a new AGENT_SECRET permission
Moved from a root action to a TransientAction attached to SlaveComputer instances
Action is only attached to computers that use JNLPLauncher

Let me know what you think @mawinter69

kalindafab and others added 3 commits February 4, 2025 11:39

Attempt to fix logText progressive memory issue in LargeText.java

8226879

Added REST API to retrieve agent secret for remote launch

79bbbd9

Merge branch 'master' into JENKINS-73735-security-agent-secret-api

3a39706

MarkEWaite changed the title ~~Jenkins 73735 security agent secret api~~ [JENKINS-73735] Add API to retrieve the agent secret Feb 27, 2025

comment-ops-bot bot added the rfe For changelog: Minor enhancement. use `major-rfe` for changes to be highlighted label Feb 27, 2025

mawinter69 suggested changes Feb 27, 2025

View reviewed changes

kalindafab added 4 commits February 27, 2025 22:01

Revert "Attempt to fix logText progressive memory issue in LargeText.…

518039f

…java" This reverts commit 8226879.

Reapply "Attempt to fix logText progressive memory issue in LargeText…

4badf64

….java" This reverts commit 7881060fcbdc725a64164e8271d753d6be062856.

Revert "Attempt to fix logText progressive memory issue in LargeText.…

2e790e2

…java" This reverts commit 8226879.

addressed review suggestions

d6c6ebc

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[JENKINS-73735] Add API to retrieve the agent secret #10354

[JENKINS-73735] Add API to retrieve the agent secret #10354

kalindafab commented Feb 27, 2025 •

edited by MarkEWaite

Loading

mawinter69 Feb 27, 2025

mawinter69 Feb 27, 2025

mawinter69 Feb 27, 2025

mawinter69 Feb 27, 2025

kalindafab Feb 27, 2025

mawinter69 Feb 27, 2025

kalindafab Feb 27, 2025

mawinter69 Feb 27, 2025

kalindafab Feb 27, 2025

mawinter69 Feb 27, 2025

mawinter69 Feb 27, 2025

mawinter69 Feb 27, 2025

mawinter69 Feb 27, 2025

kalindafab commented Mar 1, 2025

[JENKINS-73735] Add API to retrieve the agent secret #10354

Are you sure you want to change the base?

[JENKINS-73735] Add API to retrieve the agent secret #10354

Conversation

kalindafab commented Feb 27, 2025 • edited by MarkEWaite Loading

Testing done

Proposed changelog entries

Proposed changelog category

Proposed upgrade guidelines

Submitter checklist

Desired reviewers

Maintainer checklist

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kalindafab commented Mar 1, 2025

kalindafab commented Feb 27, 2025 •

edited by MarkEWaite

Loading