Creating Users

Creating users in Jenkins gives every user their own login credentials.

Analogy

Think of it as giving every student their own ID and password.

Where Users Are Managed

Navigate to:

Manage Jenkins → Manage Users

Users are managed within the configured Security Realm.

Supported security realms include:

  • Jenkins Internal User Database
  • LDAP
  • Active Directory

Enterprise Usage

In large organizations:

  • Users are typically managed through Active Directory or LDAP.
  • Users can be disabled or deleted when they leave the organization.
Advertisement

Authentication vs Authorization

Authentication

Authentication verifies who you are.

Example:

  • Username
  • Password

Authentication controls access to Jenkins.

Authorization

Authorization determines what you are allowed to do after logging in.

Examples include permissions to:

  • View Jobs
  • Build Jobs
  • Configure Jobs
  • Manage Jenkins

Authorization controls access to Jenkins actions.

Summary

  • Authentication → Who you are
  • Authorization → What you can do

Both work together to secure Jenkins.

Roles & Permissions

A role is a collection of permissions assigned to users or groups.

Instead of assigning permissions individually, permissions are grouped into roles.

Analogy

Think of a library.

A student may only be allowed to read books, while librarians have additional permissions.

Role-Based Authorization

Jenkins supports Role-Based Authorization Strategy using the Role Strategy Plugin.

Roles can be assigned to:

  • Users
  • Groups

Permissions can include:

  • Access Jobs
  • Configure Jobs
  • Build Jobs
  • Manage Jenkins

Role-Based vs Matrix-Based Authorization

Role-Based Authorization

  • Permissions grouped into named roles
  • Easier to manage
  • Supports per-job roles
  • Scales well for large teams

Matrix-Based Authorization

  • Permissions assigned individually
  • Matrix configuration
  • Less scalable for larger teams

Important Note

Incorrect role configuration can:

  • Lock users out
  • Grant excessive permissions

Roles should therefore be managed carefully.

Securing Credentials

Jenkins stores secrets inside the Credentials Store instead of hardcoding them.

Examples include:

  • Git Tokens
  • SSH Keys
  • Server Credentials
  • API Tokens

Credentials are referenced using their IDs inside:

Secrets never appear directly inside:

  • Job Configuration
  • Jenkinsfiles

The same approach is used for:

  • Git Credentials
  • Deployment Credentials
  • SMTP Credentials
  • Slack Tokens

Backup & Restore

Backing up Jenkins means safely storing Jenkins configuration and job information.

Analogy

Think of keeping a photocopy of important documents in case the originals are lost.

What to Back Up

  • $JENKINS_HOME
  • Job Configuration (config.xml)
  • Plugins
  • System Configuration

Restore

Restoring Jenkins means recovering:

  • Individual Jobs
  • Complete Jenkins Instance

Typical restore methods include:

  • Copying config.xml
  • Restoring Job Folders
  • Using Backup Plugins

Backup Plugins

ThinBackup

Supports:

  • Scheduled Backups
  • Full Backups
  • Incremental Backups

JobConfigHistory

Provides:

  • Configuration Change History
  • Configuration Rollback

Additional Notes

Backups can be:

  • Automated
  • Restored to a new Jenkins server
  • Used to restore individual jobs

Extra care should be taken when restoring:

  • Credentials
  • Secrets

Controller-Agent (Distributed Builds)

A Jenkins Agent (formerly called Slave) is a machine that executes jobs assigned by the Jenkins controller (formerly called the master — current Jenkins documentation and the UI use "controller", but many interviewers still say master).

Analogy

  • Master → Main Robot
  • Agent → Helper Robot

Master vs Agent

Feature Master Agent
Role in CI/CD Central Controller Distributed Worker
Responsibility Schedules Jobs, Manages Configuration Executes Assigned Jobs

Benefits of Master-Agent Architecture

The Master-Agent architecture distributes jobs across multiple machines.

Benefits include:

  • Parallel Execution
  • Faster Builds
  • Environment-specific Execution

Agent Connectivity

Agents connect to the Jenkins Master using:

  • SSH
  • JNLP

Agent Labels

Labels allow Jenkins to assign jobs to specific agents.

Examples include:

Executors

One agent can execute multiple jobs using configured executors.

Scaling Jenkins

Scale Jenkins by:

  • Adding New Nodes
  • Managing Offline Nodes
  • Handling Failed Nodes

Adding a New Agent

Navigate to:

Manage Nodes

Then:

  • Create Node
  • Configure Node Properties
  • Configure Launch Method

Upstream/Downstream Jobs & Best Practices

Upstream and Downstream Jobs

Upstream and downstream jobs allow Jenkins jobs to execute in sequence.

Example:

Build → Test → Deploy

Typically, downstream jobs execute only after successful completion of the previous job.

Parameterized Triggers

Parameterized triggers pass values from one job to another.

Artifact Sharing

Artifacts can also be shared between upstream and downstream jobs.

Interview Line

"We handle job dependencies using Jenkins pipelines, where each stage triggers the next. For older setups, we use upstream and downstream job triggers." Related: Jenkins Jobs.

Best Practices

  • Prefer Pipeline Stages over chained Freestyle Jobs.
  • Store Jenkinsfiles in Git.
  • Store secrets using Jenkins Credentials.
  • Prefer a single Pipeline over multiple independent jobs.
  • Convert legacy Freestyle chains into Pipelines.

Jenkins REST API (With cURL)

The Jenkins REST API allows external applications, tools, and scripts to communicate with Jenkins using HTTP requests.

Supported operations include:

  • Trigger Jobs
  • Retrieve Build Status
  • Fetch Console Logs
  • Monitor Jenkins

Analogy

Think of the REST API as the language other tools use to communicate with Jenkins.

Common REST API Endpoints

Get Job Information

GET http://jenkins-url/job/job-name/api/json

Trigger a Job

POST http://jenkins-url/job/job-name/build

Trigger a Parameterized Job

POST http://jenkins-url/job/job-name/buildWithParameters?env=qa&browser=chrome

Get Last Build Status

GET http://jenkins-url/job/job-name/lastBuild/api/json

Get Console Output

GET http://jenkins-url/job/job-name/lastBuild/consoleText

Trigger a Job Using cURL

curl -X POST http://jenkins-url/job/job-name/build --user username:APIToken

Authentication

Authenticate using:

  • Username
  • API Token

Use the API Token, not your password.

The same REST API can also be used through Postman.

Common Real-World Uses

  • Trigger Jenkins Jobs
  • Build Automation
  • Dashboard Integration
  • Retrieve Build Status
  • Download Console Logs for Debugging

Triggering Builds From Scripts: Details That Matter

  • Use an API token, not your password. Create one under your user → Security → API Token. With an API token, requests don't need a CSRF "crumb"; with a password they do, which is a common cause of 403 No valid crumb errors.
  • The build doesn't start immediately. A successful trigger returns 201 Created with a Location header pointing to a queue item. The build number only exists once the queue item leaves the queue — poll the queue item's api/json for its executable.number before fetching the build result.
  • Parameterized jobs must use buildWithParameters; calling build on them fails.
  • Keep tokens in a secret store (CI credentials, a vault, environment variables) — never in scripts committed to Git.
# Trigger with parameters and show the queue location
curl -s -i -X POST --user "qa-bot:$JENKINS_TOKEN" \
  "https://jenkins.example.com/job/regression/buildWithParameters?env=qa&browser=chrome" \
  | grep -i '^location'
# Location: https://jenkins.example.com/queue/item/4821/

Security Checklist for a Test Automation Jenkins

  • No anonymous access; everyone logs in through the company directory (LDAP/SSO).
  • Least privilege: testers can build and view test jobs; only admins manage Jenkins and credentials.
  • Test credentials (test users, API keys) stored as Jenkins credentials and masked in logs.
  • Builds run on agents, not on the controller (set the controller's executors to 0).
  • Jenkins and plugins kept up to date — most Jenkins security advisories are for plugins.
  • JENKINS_HOME backed up regularly, and a restore actually tested.

Agents that run browser tests are often Docker containers — see the Docker + Selenium Grid Guide.

From Real Projects

My API testing experience covers CRUD operations, HTTP methods, JSON path, and validating JSON and XML data. On Testsigma, a platform that itself automates API tests, understanding requests, responses and status codes was part of understanding the product. Whatever tool you use, validate the status code, the response structure and the values — not just that the call returned something. Use API tokens, not passwords, for scripts that trigger builds.

📖 Related tutorials

📚 Official documentation: OWASP Top 10 · Jenkins documentation

FAQs

What Is the Difference Between Authentication and Authorization?

Authentication

  • Verifies user identity

Authorization

  • Determines permissions

Authentication identifies the user.

Authorization determines what the user can do.

What Is the Role Strategy Plugin?

The Role Strategy Plugin enables Role-Based Authorization.

It groups permissions into named roles that can be assigned to users and groups.

It is more scalable than Matrix-Based Authorization.

How Do You Back Up Jenkins?

Back up:

  • $JENKINS_HOME
  • config.xml
  • Plugins
  • System Configuration

Use manual backups or plugins such as:

  • ThinBackup
  • JobConfigHistory

What Is a Jenkins Agent (Slave)?

A Jenkins Agent is a machine that executes jobs assigned by the Jenkins Master.

Agents connect through:

  • SSH
  • JNLP

Master-Agent architecture enables distributed builds.

What Are Upstream and Downstream Jobs?

These are chained jobs where one job automatically triggers another.

Example:

Build → Test → Deploy

Modern CI/CD generally prefers a single Pipeline instead of multiple chained Freestyle jobs.

How Do You Trigger a Jenkins Job Using the REST API?

Send a POST request to:

http://jenkins-url/job/job-name/build

Authenticate using:

  • Username
  • API Token

Example:

curl -X POST http://jenkins-url/job/job-name/build --user username:APIToken