Jenkins Security, Administration, Distributed Builds & REST API

Creating Users

Creating users in Jenkins gives every user their own login credentials.

Analogy

Think of it as giving every student their own ID and password.

Where Users Are Managed

Navigate to:

Manage Jenkins → Manage Users

Users are managed within the configured Security Realm.

Supported security realms include:

• Jenkins Internal User Database
• LDAP
• Active Directory

Enterprise Usage

In large organizations:

• Users are typically managed through Active Directory or LDAP.
• Users can be disabled or deleted when they leave the organization.

Authentication vs Authorization

Authentication

Authentication verifies who you are.

Example:

• Username
• Password

Authentication controls access to Jenkins.

Authorization

Authorization determines what you are allowed to do after logging in.

Examples include permissions to:

• View Jobs
• Build Jobs
• Configure Jobs
• Manage Jenkins

Authorization controls access to Jenkins actions.

Summary

• Authentication → Who you are
• Authorization → What you can do

Both work together to secure Jenkins.

Roles & Permissions

A role is a collection of permissions assigned to users or groups.

Instead of assigning permissions individually, permissions are grouped into roles.

Analogy

Think of a library.

A student may only be allowed to read books, while librarians have additional permissions.

Role-Based Authorization

Jenkins supports Role-Based Authorization Strategy using the Role Strategy Plugin.

Roles can be assigned to:

• Users
• Groups

Permissions can include:

• Access Jobs
• Configure Jobs
• Build Jobs
• Manage Jenkins

Role-Based vs Matrix-Based Authorization

Role-Based Authorization

• Permissions grouped into named roles
• Easier to manage
• Supports per-job roles
• Scales well for large teams

Matrix-Based Authorization

• Permissions assigned individually
• Matrix configuration
• Less scalable for larger teams

Important Note

Incorrect role configuration can:

• Lock users out
• Grant excessive permissions

Roles should therefore be managed carefully.

Securing Credentials

Jenkins stores secrets inside the Credentials Store instead of hardcoding them.

Examples include:

• Git Tokens
• SSH Keys
• Server Credentials
• API Tokens

Credentials are referenced using their IDs inside:

• Jenkins Jobs
• Jenkins Pipelines

Secrets never appear directly inside:

• Job Configuration
• Jenkinsfiles

The same approach is used for:

• Git Credentials
• Deployment Credentials
• SMTP Credentials
• Slack Tokens

Backup & Restore

Backing up Jenkins means safely storing Jenkins configuration and job information.

Analogy

Think of keeping a photocopy of important documents in case the originals are lost.

What to Back Up

• $JENKINS_HOME
• Job Configuration (config.xml)
• Plugins
• System Configuration

Restore

Restoring Jenkins means recovering:

• Individual Jobs
• Complete Jenkins Instance

Typical restore methods include:

• Copying config.xml
• Restoring Job Folders
• Using Backup Plugins

Backup Plugins

ThinBackup

Supports:

• Scheduled Backups
• Full Backups
• Incremental Backups

JobConfigHistory

Provides:

• Configuration Change History
• Configuration Rollback

Additional Notes

Backups can be:

• Automated
• Restored to a new Jenkins server
• Used to restore individual jobs

Extra care should be taken when restoring:

• Credentials
• Secrets

Master-Agent (Distributed Builds)

A Jenkins Agent (formerly called Slave) is a machine that executes jobs assigned by the Jenkins Master.

Analogy

• Master → Main Robot
• Agent → Helper Robot

Master vs Agent

Benefits of Master-Agent Architecture

The Master-Agent architecture distributes jobs across multiple machines.

Benefits include:

• Parallel Execution
• Faster Builds
• Environment-specific Execution

Agent Connectivity

Agents connect to the Jenkins Master using:

• SSH
• JNLP

Agent Labels

Labels allow Jenkins to assign jobs to specific agents.

Examples include:

• Windows Agent for Browser Testing
• Linux Agent for REST API Testing

Executors

One agent can execute multiple jobs using configured executors.

Scaling Jenkins

Scale Jenkins by:

• Adding New Nodes
• Managing Offline Nodes
• Handling Failed Nodes

Adding a New Agent

Navigate to:

Manage Nodes

Then:

• Create Node
• Configure Node Properties
• Configure Launch Method

Upstream/Downstream Jobs & Best Practices

Upstream and Downstream Jobs

Upstream and downstream jobs allow Jenkins jobs to execute in sequence.

Example:

Build → Test → Deploy

Typically, downstream jobs execute only after successful completion of the previous job.

Parameterized Triggers

Parameterized triggers pass values from one job to another.

Artifact Sharing

Artifacts can also be shared between upstream and downstream jobs.

Interview Line

"We handle job dependencies using Jenkins pipelines, where each stage triggers the next. For older setups, we use upstream and downstream job triggers."

Best Practices

• Prefer Pipeline Stages over chained Freestyle Jobs.
• Store Jenkinsfiles in Git.
• Store secrets using Jenkins Credentials.
• Prefer a single Pipeline over multiple independent jobs.
• Convert legacy Freestyle chains into Pipelines.

Jenkins REST API (With cURL)

The Jenkins REST API allows external applications, tools, and scripts to communicate with Jenkins using HTTP requests.

Supported operations include:

• Trigger Jobs
• Retrieve Build Status
• Fetch Console Logs
• Monitor Jenkins

Analogy

Think of the REST API as the language other tools use to communicate with Jenkins.

Common REST API Endpoints

Get Job Information

GET http://jenkins-url/job/job-name/api/json

Trigger a Job

POST http://jenkins-url/job/job-name/build

Trigger a Parameterized Job

POST http://jenkins-url/job/job-name/buildWithParameters?env=qa&browser=chrome

Get Last Build Status

GET http://jenkins-url/job/job-name/lastBuild/api/json

Get Console Output

GET http://jenkins-url/job/job-name/lastBuild/consoleText

Trigger a Job Using cURL

curl -X POST http://jenkins-url/job/job-name/build --user username:APIToken

Authentication

Authenticate using:

• Username
• API Token

Use the API Token, not your password.

The same REST API can also be used through Postman.

Common Real-World Uses

• Trigger Jenkins Jobs
• Build Automation
• Dashboard Integration
• Retrieve Build Status
• Download Console Logs for Debugging

FAQs

What Is the Difference Between Authentication and Authorization?

Authentication

• Verifies user identity

Authorization

• Determines permissions

Authentication identifies the user.

Authorization determines what the user can do.

What Is the Role Strategy Plugin?

The Role Strategy Plugin enables Role-Based Authorization.

It groups permissions into named roles that can be assigned to users and groups.

It is more scalable than Matrix-Based Authorization.

How Do You Back Up Jenkins?

Back up:

• $JENKINS_HOME
• config.xml
• Plugins
• System Configuration

Use manual backups or plugins such as:

• ThinBackup
• JobConfigHistory

What Is a Jenkins Agent (Slave)?

A Jenkins Agent is a machine that executes jobs assigned by the Jenkins Master.

Agents connect through:

• SSH
• JNLP

Master-Agent architecture enables distributed builds.

What Are Upstream and Downstream Jobs?

These are chained jobs where one job automatically triggers another.

Example:

Build → Test → Deploy

Modern CI/CD generally prefers a single Pipeline instead of multiple chained Freestyle jobs.

How Do You Trigger a Jenkins Job Using the REST API?

Send a POST request to:

http://jenkins-url/job/job-name/build

Authenticate using:

• Username
• API Token

Example:

curl -X POST http://jenkins-url/job/job-name/build --user username:APIToken

Related articles: Jenkins Build & Deployment: Maven Integration, pom.xml & Artifacts · Jenkins Build & Deployment: Maven Integration, pom.xml & Artifacts · Jenkins Plugins, Notifications & Monitoring: Email, Slack & Job Health