bring back ci.nodejs.org autologin

[targos]

Since last lock down for the security release, we lost the autologin to Jenkins. I didn't think it was a big deal because it's just one click away, but there's a problem: if one clicks on a direct CI link without logging in first, a 404 error is displayed (test with https://ci.nodejs.org/job/node-test-pull-request/31749/ in a private browser window).
Can we bring the autologin back?

[richardlau]

The last lock down coincided with a GitHub issue with logins: https://www.githubstatus.com/incidents/q3cfsrp1qb6l

It's not clear if the issue is on our side or is related to the GitHub issue above. For reference, the steps for the lock down (and undoing of) are in https://github.com/nodejs/build/blob/master/doc/jenkins-guide.md#security-releases.

[richardlau]

This is a stab in the dark but I compared again the screenshot from #2336 (comment) to our current security matrix and noticed we had a few read permissions for "Anonymous Users" (e.g. "Overall system read" but not "Job read") that we didn't have before. Maybe the issue is that Jenkins is allowing unauthenticated access (i.e. not logged in)?

I've removed all permissions from "Anonymous Users" (we still have the equivalent read permissions for "Authenticated Users"). I'll check back again later today to see if Jenkins drops my login again.

[addaleax]

@richardlau That seems to have worked, although now it requires non-authenticated users to also log in through github.

[richardlau]

@richardlau That seems to have worked, although now it requires non-authenticated users to also log in through github.

I think that's what we had in the past?

[richardlau]

@richardlau That seems to have worked, although now it requires non-authenticated users to also log in through github.

I think that's what we had in the past?

I guess to expand on this a little when we did the last round of security updates I took a screenshot (#2336 (comment)) of the permissions we had set before locking down the CI. When we undid the lockdown I manually put everything back as it was in that screenshot but @sam-github also restored permissions based on the screenshot in our current process docs at the same time and we ended up with permissions as documented rather than as they were.

I have a PR to update the "normal" permissions in #2344.