upgrading gitlab branch source to version 646 yields an error: Error while validating token: anonymous is missing the Overall/Administer permission

[moshavnik]

Jenkins and plugins versions report

Environment

Jenkins: 2.375.3
OS: Linux - 3.10.0-1160.76.1.el7.x86_64
Java: 11.0.17 - Red Hat, Inc. (OpenJDK 64-Bit Server VM)

Parameterized-Remote-Trigger:3.1.6.3
active-directory:2.30
additional-metrics:56.v426e1e69d12a_
agent-maintenance:1.76.v6396206d534f
all-changes:1.5
allure-jenkins-plugin:2.30.3
analysis-model-api:10.23.1
ansible:148.v6b_13c6de3a_47
ansicolor:1.0.2
ant:481.v7b_09e538fcca
antisamy-markup-formatter:155.v795fb_8702324
any-buildstep:14.ve115ec1484f0
apache-httpcomponents-client-4-api:4.5.14-150.v7a_b_9d17134a_5
artifact-repository-parameter:2.0.1
artifactdeployer:1.3
artifactory:3.18.0
assertthat-bdd-jira:1.7
atlassian-jira-software-cloud:2.0.7
authentication-tokens:1.4
authorize-project:1.4.0
autocancel:1.0.5
aws-credentials:191.vcb_f183ce58b_9
aws-java-sdk:1.12.406-370.v8f993c987059
aws-java-sdk-cloudformation:1.12.406-370.v8f993c987059
aws-java-sdk-codebuild:1.12.406-370.v8f993c987059
aws-java-sdk-ec2:1.12.406-370.v8f993c987059
aws-java-sdk-ecr:1.12.406-370.v8f993c987059
aws-java-sdk-ecs:1.12.406-370.v8f993c987059
aws-java-sdk-efs:1.12.406-370.v8f993c987059
aws-java-sdk-elasticbeanstalk:1.12.406-370.v8f993c987059
aws-java-sdk-iam:1.12.406-370.v8f993c987059
aws-java-sdk-logs:1.12.406-370.v8f993c987059
aws-java-sdk-minimal:1.12.406-370.v8f993c987059
aws-java-sdk-sns:1.12.406-370.v8f993c987059
aws-java-sdk-sqs:1.12.406-370.v8f993c987059
aws-java-sdk-ssm:1.12.406-370.v8f993c987059
badge:1.9.1
basic-branch-build-strategies:71.vc1421f89888e
blueocean:1.27.2
blueocean-autofavorite:1.2.5
blueocean-bitbucket-pipeline:1.27.2
blueocean-commons:1.27.2
blueocean-config:1.27.2
blueocean-core-js:1.27.2
blueocean-dashboard:1.27.2
blueocean-display-url:2.4.1
blueocean-events:1.27.2
blueocean-git-pipeline:1.27.2
blueocean-github-pipeline:1.27.2
blueocean-i18n:1.27.2
blueocean-jira:1.27.2
blueocean-jwt:1.27.2
blueocean-personalization:1.27.2
blueocean-pipeline-api-impl:1.27.2
blueocean-pipeline-editor:1.27.2
blueocean-pipeline-scm-api:1.27.2
blueocean-rest:1.27.2
blueocean-rest-impl:1.27.2
blueocean-web:1.27.2
bootstrap4-api:4.6.0-5
bootstrap5-api:5.2.1-3
bouncycastle-api:2.27
branch-api:2.1071.v1a_188a_562481
build-environment:1.7
build-failure-analyzer:2.4.1
build-history-manager:1.6.0
build-history-metrics-plugin:97.vdcf3aa48af8d
build-monitor-plugin:1.13+build.202205140447
build-name-setter:2.2.0
build-time-blame:64.vd8f4018a2bbe
build-timeout:1.28
build-timestamp:1.0.3
build-user-vars-plugin:1.9
build-with-parameters:76.v9382db_f78962
buildtriggerbadge:251.vdf6ef853f3f5
built-on-column:1.3
caffeine-api:2.9.3-65.v6a_47d0f4d1fe
calendar-view:0.3.2
checks-api:1.8.1
claim:516.v36293563731d
clearcase:1.6.8
cloudbees-bitbucket-branch-source:796.v6cb_1559e1673
cloudbees-disk-usage-simple:178.v1a_4d2f6359a_8
cloudbees-folder:6.815.v0dd5a_cb_40e0e
cloudbees-jenkins-advisor:336.v4d00382fe22c
clover:4.13.0
cmakebuilder:4.1.1
cobertura:1.17
code-coverage-api:3.5.0
command-launcher:90.v669d7ccb_7c31
commons-httpclient3-api:3.1-3
commons-lang3-api:3.12.0-36.vd97de6465d5b_
commons-text-api:1.10.0-36.vc008c8fcda_7b_
compact-columns:1.169.v60b_7d496b_860
concurrent-step:1.0.0
conditional-buildstep:1.4.2
config-driven-pipeline:1.3
config-file-provider:3.11.1
configuration-as-code:1569.vb_72405b_80249
configuration-as-code-groovy:1.1
configurationslicing:430.v966357576543
confluence-publisher:136.vc30a_a_0d845d7
console-badge:1.1
console-column-plugin:197.vcf5a_ec1d7b_47
container-image-link:11.v2fee68a69c54
content-replace:1.7.0
conventional-commits:0.11.2
convert-to-pipeline:1.0
copyartifact:686.v6fd37018d7c2
cppcheck:1.26
credentials:1214.v1de940103927
credentials-binding:523.vd859a_4b_122e6
cucumber-reports:5.7.5
custom-build-properties:2.82.v16d5b_d3590c7
custom-folder-icon:2.3
custom-tools-plugin:0.8
customize-build-now:1.1
cvs:2.19.1
dark-theme:302.vf069cb_e01486
dashboard-view:2.472.v9ff2a_e6a_c529
data-tables-api:1.12.1-4
database:148.v4a_ff2ca_608b_7
database-mysql:1.4
database-postgresql:1.2
database-sqlite:1.3
date-parameter:0.0.4
declarative-pipeline-migration-assistant:1.5.5
declarative-pipeline-migration-assistant-api:1.5.5
deploy:1.16
describe-with-params:1.0
display-url-api:2.3.7
docker-build-publish:1.4.0
docker-commons:1.21
docker-compose-build-step:1.0
docker-custom-build-environment:1.7.3
docker-java-api:3.2.13-68.va_875df25a_b_45
docker-plugin:1.3.0
docker-workflow:563.vd5d2e5c4007f
dockerhub-notification:2.6.3
dotnet-sdk:1.4.0
downstream-build-cache:1.7
dtkit-api:3.0.2
durable-task:504.vb10d1ae5ba2f
echarts-api:5.4.0-1
editable-choice:60.v68c6aa7fa01e
email-ext:2.94
email-ext-recipients-column:27.vb_9404db_b_018d
emailext-template:1.5
embeddable-build-status:339.v1edb_5e63da_45
enhanced-metrics:1.6
enhanced-old-build-discarder:1.4
envinject-api:1.199.v3ce31253ed13
extended-choice-parameter:359.v35dcfdd0c20d
extended-read-permission:3.2
extensible-choice-parameter:1.8.0
external-monitor-job:203.v683c09d993b_9
external-workspace-manager:1.2.3
extra-columns:1.25
extra-tool-installers:1.2
fail-the-build-plugin:5.v153b_2c826ef0
favorite:2.4.1
file-leak-detector:1.11
file-operations:1.11
file-parameters:264.v1733d9b_2a_380
files-found-trigger:1.5
filesystem-list-parameter-plugin:0.0.8
flexible-publish:0.16.1
folder-properties:1.2.1
font-awesome-api:6.2.1-1
forensics-api:1.17.0
fstrigger:1.00
generic-event:40.v080de468d609
generic-webhook-trigger:1.86.2
git:5.0.0
git-automerger:0.6.3
git-changelog:3.28
git-chooser-alternative:1.1
git-client:4.1.0
git-forensics:1.11.0
git-parameter:0.9.18
git-push:34.vd474e0fe7b_ec
git-server:99.va_0826a_b_cdfa_d
git-tag-message:1.7.1
git-userContent:1.4
github:1.37.0
github-api:1.303-400.v35c2d8258028
github-branch-source:1701.v00cc8184df93
github-checks:1.0.19
github-pr-comment-build:86.v23ae6d00ab99
github-pr-coverage-status:2.2.0
github-pullrequest:0.5.0
gitlab-api:5.0.1-78.v47a_45b_9f78b_7
gitlab-branch-source:645.v62a_b_6fce8659
gitlab-logo:1.1.0
gitlab-merge-request-jenkins:2.0.0
gitlab-plugin:1.7.7
google-oauth-plugin:1.0.7
gradle:2.3
groovy:453.vcdb_a_c5c99890
groovy-postbuild:2.5
grypescanner:1.4
h2-api:1.4.199
handy-uri-templates-2-api:2.1.8-22.v77d5b_75e6953
hp-application-automation-tools-plugin:7.7
htmlpublisher:1.31
http_request:1.16
hudson-wsclean-plugin:1.0.8
image-tag-parameter:2.0
inline-pipeline:1.0.2
inodes-monitor:0.5.1
instance-identity:142.v04572ca_5b_265
ionicons-api:31.v4757b_6987003
ivy:2.4
jackson2-api:2.14.2-319.v37853346a_229
jacoco:3.3.2
jakarta-activation-api:2.0.1-3
jakarta-mail-api:2.0.1-3
javadoc:226.v71211feb_e7e9
javax-activation-api:1.2.0-6
javax-mail-api:1.6.2-9
jaxb:2.3.8-1
jdk-tool:63.v62d2fd4b_4793
jenkins-design-language:1.27.2
jenkins-jira-plugin:4.0.0
jersey2-api:2.39-1
jfrog:1.0.5
jira:3.9
jira-ext:0.9
jira-steps:2.0.165.v8846cf59f3db
jira-trigger:1.0.2
jjwt-api:0.11.5-77.v646c772fddb_0
jnr-posix-api:3.1.16-2
job-dsl:1.81
job-import-plugin:3.6
job-parameter-summary:0.5
job-restrictions:0.8
jobConfigHistory:1206.vc8967cc8a_2cb_
jobcacher:376.v1db_b_44565f7b_
jobtag:25.va_12b_1dd63367
jquery:1.12.4-1
jquery3-api:3.6.1-2
jsch:0.1.55.61.va_e9ee26616e7
junit:1177.v90374a_ef4d09
junit-attachments:131.vef2117770555
junit-realtime-test-reporter:90.v7dc2c937f9a_8
kerberos-sso:1.11
kotlin-v1-stdlib-jdk8:1.3.20-1.4
kubernetes:3893.v73d36f3b_9103
kubernetes-cli:1.12.0
kubernetes-client-api:6.4.1-215.v2ed17097a_8e9
kubernetes-credentials:0.10.0
last-changes:2.7.11
ldap:659.v8ca_b_a_fe79fa_d
leastload:3.0.0
list-git-branches-parameter:0.0.13
locale:226.v008e1b_58cb_b_0
lockable-resources:1123.v4002ee23c671
log-parser:2.3.0
login-theme:1.1
m2release:0.16.3
mail-watcher-plugin:1.18
mailer:448.v5b_97805e3767
managed-scripts:1.5.6
mapdb-api:1.0.9-28.vf251ce40855d
mask-passwords:150.vf80d33113e80
matlab:2.9.0
matrix-auth:3.1.6
matrix-combinations-parameter:1.3.2
matrix-project:785.v06b_7f47b_c631
maven-dependency-update-trigger:1.5
maven-info:0.3.1
maven-plugin:3.21
maven-snapshot-check:186.v844b_fed00d1b
metrics:4.2.13-420.vea_2f17932dd6
mina-sshd-api-common:2.9.2-50.va_0e1f42659a_a
mina-sshd-api-core:2.9.2-50.va_0e1f42659a_a
miniorange-saml-sp:2.0.1
monitoring:1.92.0
msbuild:1.30
mstest:1.0.0
mstestrunner:1.5.0
multi-module-tests-publisher:1.44
multibranch-action-triggers:1.8.6
multibranch-build-strategy-extension:1.0.10
multibranch-scan-webhook-trigger:1.0.9
multiselect-parameter:1.4
muuri-api:0.9.5-3
naginator:1.18.2
nant:248.vcc8a_3eec8db_a
next-build-number:1.8
next-executions:1.0.15
node-iterator-api:49.v58a_8b_35f8363
nodejs:1.6.0
nodelabelparameter:1.11.0
notification:1.15
notify-events:1.6.2
npm-yarn-wrapper-steps:0.4.0
nuget:1.1
nunit:0.28
oauth-credentials:0.5
okhttp-api:4.10.0-125.v3593b_a_f8c97b_
ownership:0.13.0
pam-auth:1.10
parameterized-scheduler:1.2
parameterized-trigger:2.45
percentage-du-node-column:0.1.0
pipeline-aggregator-view:1.15
pipeline-build-step:486.vd08f550cceee
pipeline-config-history:1.6
pipeline-cps-http:0.3.1
pipeline-github:2.8-138.d766e30bb08b
pipeline-github-lib:38.v445716ea_edda_
pipeline-githubnotify-step:49.vf37bf92d2bc8
pipeline-graph-analysis:202.va_d268e64deb_3
pipeline-graph-view:163.v84cf2343b_266
pipeline-groovy-lib:629.vb_5627b_ee2104
pipeline-input-notification:15.v175f12f20f9e
pipeline-input-step:466.v6d0a_5df34f81
pipeline-maven:1257.v89e586d3c58c
pipeline-milestone-step:111.v449306f708b_7
pipeline-model-api:2.2118.v31fd5b_9944b_5
pipeline-model-definition:2.2118.v31fd5b_9944b_5
pipeline-model-extensions:2.2118.v31fd5b_9944b_5
pipeline-multibranch-defaults:2.1
pipeline-npm:23.ve3416e2f5249
pipeline-project-env:88.v121b_f0c9059a
pipeline-rest-api:2.31
pipeline-stage-step:305.ve96d0205c1c6
pipeline-stage-tags-metadata:2.2118.v31fd5b_9944b_5
pipeline-stage-view:2.31
pipeline-timeline:1.0.3
pipeline-utility-steps:2.15.1
plain-credentials:143.v1b_df8b_d3b_e48
platformlabeler:1834.v30a_0cdf167e7
plugin-usage-plugin:4.0
plugin-util-api:2.20.0
pollscm:1.3.1
popper-api:1.16.1-3
popper2-api:2.11.6-2
postbuild-task:1.9
postbuildscript:3.2.0-460.va_fda_0fa_26720
powershell:2.0
preSCMbuildstep:44.v6ef4fd97f56e
prism-api:1.29.0-2
prometheus:2.1.1
promoted-builds:892.vd6219fc0a_efb
publish-over:0.22
publish-over-cifs:0.16
publish-over-ftp:1.17
pubsub-light:1.17
purge-job-history:1.6
pyenv-pipeline:2.1.2
python:1.3
rabbitmq-build-trigger:2.5
rabbitmq-consumer:2.8
rabbitmq-publisher:1.3.1
rebuild:1.34
remote-file:1.23
repository-connector:2.2.0
resource-disposer:0.21
rest-list-parameter:1.6.3
rich-text-publisher-plugin:1.4
run-condition:1.5
run-selector:1.1.1
saml:4.385.v4dea_91565e9d
schedule-build:422.v5340de213c7e
scm-api:631.v9143df5b_e4a_a
scm-filter-branch-pr:0.5.1
script-security:1229.v4880b_b_e905a_6
scriptler:3.5
select2-api:4.0.13-8
seleniumhtmlreport:1.1
semantic-versioning-plugin:1.15
shelve-project-plugin:3.2
sidebar-link:2.2.1
sidebar-update-notification:1.1.0
simple-theme-plugin:146.v0e67db_a_9052e
snakeyaml-api:1.33-95.va_b_a_e3e47b_fa_4
sonar:2.15
sse-gateway:1.26
ssh:2.6.1
ssh-agent:295.v9ca_a_1c7cc3a_a_
ssh-credentials:305.v8f4381501156
ssh-slaves:2.854.v7fd446b_337c9
ssh-steps:2.0.65.vd26b_5b_9b_de4d
sshd:3.275.v9e17c10f2571
startup-trigger-plugin:2.9.3
strict-crumb-issuer:2.1.0
structs:324.va_f5d6774f3a_d
subversion:2.17.1
support-core:1262.vc248605ec68b
swarm:3.39
synopsys-coverity:3.0.3
terraform:1.0.10
test-results-aggregator:1.2.11
test-results-analyzer:0.4.0
text-finder:1.22
theme-manager:1.6
thinBackup:1.15
timestamper:1.22
token-macro:321.vd7cc1f2a_52c8
tracking-git:1.0
trilead-api:2.84.v72119de229b_7
uno-choice:2.6.4
urltrigger:1.02
validating-string-parameter:2.8
validating-yaml-parameter:89.vf13c6b_f41036
variant:59.vf075fe829ccb
versioncolumn:95.v82f3985cd6e1
versionnumber:1.10
view-job-filters:2.3
vstestrunner:1.0.8
warnings-ng:9.23.1
webhook-step:173.vfa_b_93560b_977
windows-cloud:1.0.1
wix:1.12
workflow-aggregator:590.v6a_d052e5a_a_b_5
workflow-api:1208.v0cc7c6e0da_9e
workflow-basic-steps:1010.vf7a_b_98e847c1
workflow-cps:3624.v43b_a_38b_62b_b_7
workflow-durable-task-step:1234.v019404b_3832a
workflow-job:1282.ve6d865025906
workflow-multibranch:733.v109046189126
workflow-remote-loader:1.5
workflow-scm-step:400.v6b_89a_1317c9a_
workflow-step-api:639.v6eca_cd8c04a_a_
workflow-support:839.v35e2736cfd5c
ws-cleanup:0.44
xtrigger-api:1.0
xunit:3.1.2
yet-another-build-visualizer:1.16
zentimestamp:4.2

What Operating System are you using (both controller, and any agents involved in the problem)?

linux, centos, version is not relevant to the issue.
no agent is involved.

Reproduction steps

1. install gitlab branch source plugin version 645.
2. setup a gitlab server and connection .
3. create a multibranch pipeline to any repo, using the gitlab branch source plugin.
4. set the job to run on any push to the repo.
5. add a Jenkinsfile to the repo in gitlab, make it simple like println "hello world"
6. make sure you are able to run the job manually, and trigger it automatically when a push is made to the repo.
7. update the gitlab branch source plugin to 646.
8. push something the branch containing the Jenkinsfile.

Expected Results

jenkins job of the branch with the new push should run automatically.

Actual Results

job doesn't run.
warning appears in the jenkins controller log file:

WARNING i.j.p.g.GitLabSystemHookAction#isValidToken: Error while validating token: anonymous is missing the Overall/Administer permission

Anything else?

1. entire error from log file is attached.
2. downgrading to gitlab branch source 645 solves the issue.
   gitlab-branch-source-problem-646.txt

[hcorg]

issue can be reproduced also when upgrading from 644.va_a_66886e07b_5 to 646.vb_9560d64b_69f

it's a blocker - I was unable to change the configuration to a working one

any workarounds?

[fredg02]

I'm looking into it.

[t0rb3n]

Not sure if this and the bug I am experiencing are related but after the update to 646 the webhooks in GitLab are failing with HTTP Error 401.

[bguerin]

@t0rb3n this is related ;)

[Stikus]

What should I do to fix this error? All our webhooks are now broken.

Downgrading back to 644 doesn't help due to this:

Should I generate a new secret token and update this field?

[mscholze]

This issue is related to the following ticket: https://issues.jenkins.io/browse/JENKINS-70746

[yogeek]

same error here, all our jenkins are configured with Config-as-Code and were impacted by the issue :-(

The rollback consisting in :

• downgrade the plugin to the previous version (gitlab-branch-source:646.vb_9560d64b_69f to gitlab-branch-source:644.va_a_66886e07b_5 in our case) in our plugins.txt file
• put back the old conf in our configuration-as-code gitlab section

unclassified:
  gitLabServers:
    servers:              
      - name: "gitlab"
        serverUrl: "https://{{ gitlab_hostname }}"
        credentialsId: "{{ gitlab_jenkins_access_token_credentials_id }}"
        webhookSecretCredentialsId: "gitlab-jenkins-api-read-token"
        manageWebHooks: true
        manageSystemHooks: false

to

unclassified:
  gitLabServers:
    servers:              
      - name: "gitlab"
        serverUrl: "https://{{ gitlab_hostname }}"
        credentialsId: "{{ gitlab_jenkins_access_token_credentials_id }}"
        secretToken: "{XXXYYYZZZ=}"
        manageWebHooks: true
        manageSystemHooks: false

seems to work for now (we had to scan some gitlab groups in jenkins to reconfigure the webhooks in gitlab)

[AB-xdev]

Same problem here. Going to downgrade back to a working version.

Problem is likely caused by

gitlab-branch-source-plugin/src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java

Line 377 in b9560d6

jenkins.checkPermission(Jenkins.ADMINISTER);

however I can't tell that I'm 100% sure because the stacktrace is due to some reason cut away in

gitlab-branch-source-plugin/src/main/java/io/jenkins/plugins/gitlabbranchsource/GitLabWebHookAction.java

Line 94 in b9560d6

LOGGER.log(Level.WARNING, String.format("Error while validating token: %s", e.getMessage()));

Also note that there's now a new method that also contains permission checks, however it looks unused:

gitlab-branch-source-plugin/src/main/java/io/jenkins/plugins/gitlabserverconfig/servers/GitLabServer.java

Lines 327 to 360 in b9560d6

	/**
	* Looks up for StringCredentials
	*
	* @return {@link StringCredentials}
	*/
	public StringCredentials getWebhookSecretCredentials(AccessControlled context) {
	Jenkins jenkins = Jenkins.get();
	if (context == null) {
	jenkins.checkPermission(CredentialsProvider.USE_OWN);
	return StringUtils.isBlank(webhookSecretCredentialsId) ? null : CredentialsMatchers.firstOrNull( lookupCredentials(
	StringCredentials.class,
	jenkins,
	ACL.SYSTEM,
	fromUri(defaultIfBlank(serverUrl, GITLAB_SERVER_URL)).build()
	), withId(webhookSecretCredentialsId));
	} else {
	context.checkPermission(CredentialsProvider.USE_OWN);
	if (context instanceof ItemGroup) {
	return StringUtils.isBlank(webhookSecretCredentialsId) ? null : CredentialsMatchers.firstOrNull( lookupCredentials(
	StringCredentials.class,
	(ItemGroup) context,
	ACL.SYSTEM,
	fromUri(defaultIfBlank(serverUrl, GITLAB_SERVER_URL)).build()
	), withId(webhookSecretCredentialsId));
	} else {
	return StringUtils.isBlank(webhookSecretCredentialsId) ? null : CredentialsMatchers.firstOrNull( lookupCredentials(
	StringCredentials.class,
	(Item) context,
	ACL.SYSTEM,
	fromUri(defaultIfBlank(serverUrl, GITLAB_SERVER_URL)).build()
	), withId(webhookSecretCredentialsId));
	}
	}
	}

[cpt1gl0]

Same here.

[serge2016]

Hi! Can we hope for a fix in the nearest feature?

[AnnD-K]

Same here, downgraded to gitlab-branch-source:645.v62a_b_6fce8659

[Stikus]

Can anyone give me advice - after downgrade my SecretToken was empty, and I've added new secret. After this, I've reconfigured some jobs, and they start work again, but I don't want to reconfigure all jobs.

If I don't remember old secret - can I avoid this? Or where can I find old secret? We have backups, but looks like UI doesn't show secret both on jenkins or gitlab and we don't have configuration as code plugin.