<p>If you're running this code today via script console, you're probably running into a RejectedAccessException from the sandbox which is why you require admin access to run this coupled with and or needing administrator access to use the script console.</p>

<p>If you put this code into a <a href="https://jenkins.io/doc/book/pipeline/shared-libraries/" rel="nofollow noreferrer">shared library</a>, the code becomes trusted, and you no longer require administrator access to run the code and you no longer need script console. You just need a job that can call the shared library, if needed you can restrict access to the folder or job.</p>

CC BY-SA 4.0
2019-08-02T15:57:11.020Z
2019-08-02T15:57:11.020Z
casey vega
<p>We have been using groovy script to read the build queue state:</p>

<pre><code>def builder = new groovy.json.JsonBuilder()

builder {
  queueItems(Jenkins.instance.queue.items.collect { obj -&gt;
      [
        id: obj.id,
        name: obj.task.name,
        isStuck: obj.stuck,
        isBlocked: obj.blocked,
        isDisabled: obj.task.disabled,
        inQueueSince: obj.inQueueSince,
        why: obj.why,
        causesDescription: obj.causesDescription,
        queueItemUrl: obj.url,
        taskUrl: obj.task.url
      ]
   })
}

println builder.toPrettyString()
</code></pre>

<p>Then we add <a href="https://plugins.jenkins.io/azure-ad" rel="nofollow noreferrer">Azure AD plugin</a>. It requires an account with the <code>hudson.model.Hudson.Administer</code> permission to run a script.</p>

<p>We use a tech account, but the problem is that everyone can logon interactively using this login and became Jenkins admin.</p>

<p>Is it possible to have this account enabled, but restrict interactive logon to Jenkins?</p>

<jenkins><security>
Restrict user logon in Jenkins
Skyblade
# Restrict user logon in Jenkins

(Asked by: username_0 on 2019-08-02)

We have been using groovy script to read the build queue state:
def builder = new groovy.json.JsonBuilder()

builder {
  queueItems(Jenkins.instance.queue.items.collect { obj ->
      [
        id: obj.id,
        name: obj.task.name,
        isStuck: obj.stuck,
        isBlocked: obj.blocked,
        isDisabled: obj.task.disabled,
        inQueueSince: obj.inQueueSince,
        why: obj.why,
        causesDescription: obj.causesDescription,
        queueItemUrl: obj.url,
        taskUrl: obj.task.url
      ]
   })
}

println builder.toPrettyString()

Then we add Azure AD plugin. It requires an account with the hudson.model.Hudson.Administer permission to run a script.
We use a tech account, but the problem is that everyone can logon interactively using this login and became Jenkins admin.
Is it possible to have this account enabled, but restrict interactive logon to Jenkins?

**Tags:** jenkins, security


---

## 1 answers

### Answer by username_1 on 2019-08-02. Score: 1 | Accepted answer

If you're running this code today via script console, you're probably running into a RejectedAccessException from the sandbox which is why you require admin access to run this coupled with and or needing administrator access to use the script console.

If you put this code into a [shared library](https://jenkins.io/doc/book/pipeline/shared-libraries/), the code becomes trusted, and you no longer require administrator access to run the code and you no longer need script console. You just need a job that can call the shared library, if needed you can restrict access to the folder or job.


---

