In the first part of this series I covered installing several PHP tools for continuous integration testing (PHPUnit, Mess Detecter, Copy Paste Detecter, Code Sniffer, Code Coverage, Documenter 2, Lines of Code, and Simple Test) and installing Jenkins. You can find the first part here In this part I will cover installing the needed plugins to use the installed PHP tools and to authenticate to active directory, and to use HTTPS (SSL) instead of the standard HTTP connection.
If the Jenkins server is currently running (if you just finished up part 1, it probably is) stop the server by running the following command
$/etc/init.d/jenkins stop
Setup the LDAP / AD Certificate
If you care planning to connect to an LDAP server or Active Directory and use LDAPS when doing so, you will need to let Jenkins know about the certificate the server has. To do so following the following steps:
Download the InstallCert tool from here
Install the unzip application
$apt-get install unzip
Unzip the tool
$unzip InstallCert.zip
Move the tool the the Java bin location
$mv InstallCert* $JAVA_HOME/jre/bin
Get the servers certificate. If you have multiple servers to get certs from, repeat this step for each.
$java InstallCert someServer.example.com:636
If you are prompted for anything, just press enter to continue on.
The certificate(s) will be placed in a file called jssecerts. Now we need to import this file into the cacerts file that java uses.
$keytool --importkeystore -srckeystore jssecacerts -destkeystore $JAVA_HOME/jre/lib/security/cacerts -noprompt
The password for the keystore is “changeit”.
To inform Jenkins of the cacerts file, edit the file /etc/defaults/jenkins and add the line to the file before the end (preferable under the commented out JAVA_ARGS line)
JAVA_ARGS="-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts"
Setting Up SSL (HTTPS)
Edit the file /etc/defaults/jenkins and add the following lines
HTTPS_PORT=8443 HTTPS_KEYSTORE=/etc/ssl/certs/java/YourCertFile.crt HTTPS_KEYSTORE_KEY=/etc/ssl/certs/java/YourCertKeyFile.key
Also set HTTP_PORT line to -1 to disable it
HTTP_PORT = -1
At the bottom of the file, set the JENKINS_ARGS line to the following
JENKINS_ARGS="--webroot=/var/cache/jenkins/war --httpPort=$HTTP_PORT --ajp13Port=$AJP_PORT --httpsPort=$HTTPS_PORT --httpsCertificate=$HTTPS_KEYSTORE --httpsPrivateKey=$HTTPS_KEYSTORE_KEY"
Installing the Plugins
- Open a web browser and go to https://yourServer. example.com:8443
- Click on Manage Jenkins
- Click on Manage Plugins
- Select the “Available” tab
- Select the following plugins
- Active Directory Plugin
- checkstyle
- clover php plugin
- dry
- html publisher plugin
- jdepend plugin
- plot plugin
- pmd plugin
- violations
- xUnit plugin
- Click “Install without Restart”
Setup Authentication to Active Directory
- Go to Manage Jenkins -> Configure Global Security
- Check “Enable Security”
- Select “Active Directory” under the Security Realm section
- Click “Advanced”
- Set the following fields:Domain Name: example.com
Bind DN: CN=someUser,OU=Users,DC=example,DC=com
Bind Password: TheBindUsersPassword - Click “Test”
- If all is good, click “Apply”, else trouble shoot the issue
- Click “Save”
- Try to authenticate as a known user by clicking “log in” in the upper right corder and authenticating
NOTE: This setup did not work when I entered a domain controller. If I left the field blank, Jenkins was able to find the appropriate server and authenticate without issue.
Setting up LDAP Authentication
If you don’t want to use the active directory plugin, you can also authenticate using LDAP functionality Jenkins already has.
- Go to Manage Jenkins -> Configure Global Security
- Check “Enable Security”
- Under the Security Realm section, select “LDAP”
- Set the following fields:Server: ldaps://someServer.example.com:636
User Search Filter: sAMAccountName={0}
Manager DN:CN=someUser,OU=Users,DN=example,DN=com
Manager Password:The manager users password - Click “Apply”
- Click “Save”
- Test authenticating as a known user by clicking the “log in” link in the upper right corner and trying to log in
NOTE: If you intend to authenticate to an LDAP server like eDir (Novell) do not set the User Search Field to sAMAccountName={0} as it will not work
A Little Extra Security
To help prevent Cross-Site Scripting do the following:
- Go to Manage Jenkins -> Configure Global Security
- Check “Prevent Cross Site Request Forgery Exploits”
- Select “Default Crumb Issuer”
- Click “Apply”
- Click “Save”
Configuring Access
Now that you have users authenticating to Jenkins, you should limit what they can do. By default, Jenkins allows all users to do all things.
- Go to Manage Jenkins -> Configure Global SecurityUnder the “Authorization” section select “Project-based Matrix Authorization Strategy”
- Enter your username in the “User/group to add” field and click the “Add” button
- You should probably give yourself full permissions, you can do this quickly by clicking the image next to the red X on the right side of the row for your user
- If you want to add a group, just enter the group name in the “User/group to add” filed and click add. You used to have to prefix groups with ROLE_, but this is no longer required
- Set the permissions for the group or users you add to the list
NOTE: Under this authorization scheme, the permissions given to the users or groups here should be their base permissions site wide. In other words, give them the minimum amount here. Then in the projects they are a working on, you can specify additional rights under the “job configuration screen” for the project.
Technical Blogging of the Fuzzy IT Kind 