Cannot Resolve Class Exception: hudson. security. Global Matrix Authorization Strategy

Using Jenkins
1

Lately I’ve been getting this error whenever I quit Jenkins altogether and restart it:
“com.thoughtworks.xstream.mapper.CannotResolveClassException: hudson.security.GlobalMatrixAuthorizationStrategy”

I think it has been happening since recently updating to the latest version of Jenkins (from a version about a year old).

It is alarming every time because Jenkins won’t launch when it happens, and the only way I know to fix it is to just delete my .jenkins folder and restore it from the backup I’m doing every night (of the whole folder, not sure if that’s necessary or not…).

Does anyone know how I can fix this? I am afraid that one day my backup trick isn’t going to work and I’ll be stuck with a DOA Jenkins.

I don’t even know that I need this plugin - but if I try to disable it, then I get the same error…

2

I have seen this recently during start up after doing a large LTS jump in versions.

I had to do multiple smaller upgrades to get around seeing that error message.

1 Like
3

Can you search on your Jenkins_home if there are any occurence of the GlobalMatrixAuthorizationStrategy string in the XML files (recursive content research: be careful on the I/O if your Jenkins controller is heavily used) ?

The found files would give more indications.

The plugin which implements this class is the Matrix Authorization Strategy which allows defining permissions for job on differents locations: globally (main configuration), but also per folder and per job, which could map to different XML configuration files.

Additionnaly, please provide more context otherwise it is hard to help:

4

The only thing I find is this in config.xml:


<authorizationStrategy class="hudson.security.GlobalMatrixAuthorizationStrategy">
    <permission>hudson.model.Hudson.Administer:authenticated</permission>
    <permission>hudson.model.Hudson.Read:anonymous</permission>
    <permission>hudson.model.Item.Read:anonymous</permission>
    <permission>hudson.model.View.Read:anonymous</permission>
  </authorizationStrategy>

I tried just removing that. I also tried removing the plugin’s folder and .jpi file from the jenkins home folder. When I do that, it says that it starts - I no longer see that error - but the screen is white. The UI never appears. And it I look at config.xml after that, it has this:

<authorizationStrategy class="hudson.security.AuthorizationStrategy$Unsecured"/>

I read something somewhere about how you could set useSecurity to false to get it to start up, but that is not working for me.

EDIT: I was able to get it running again - by my old method of completely deleting my jenkins home folder and restoring from backup. Then I went into the plugin manager and uninstalled that MatrixAuthorization plugin. When I quit jenkins and restarted, I got that same error - but removing the block of code from config.xml this time did allow it to start. So hopefully that nasty plugin is gone from my life now :slight_smile:

5

Rude :frowning_face:

FWIW this error usually happens when the plugin is not installed, disabled, or fails to load. The latter can happen in case of unsatisfied dependencies, often caused by doing manual plugin management in the $JENKINS_HOME/plugins/ folder. The Jenkins log should tell you which plugins failed to load and why during startup.

1 Like
6

I encountered this issue during an upgrade. It is because this particular plugin was outdated. I had to revert the upgrade, then update the plugins especially the one mentioned here. Next I upgraded again and did not encounter the issue.

7

I am getting the same error on startup. I am on a release now that works but if I try to update any further it throws that error and does not load.

I tried updating the plug, download the .hpi file and load it, but it then also throws this error. Any thoughts? Thanks.

8

My previous answer still applies. Check the logs for messages relating to matrix-auth failing to load and address the reason.

9

This was an issue for me coming from 2.462.1 to 2.504.1. The problem is really how Jenkins manages updates. In 2.462.1 all plugins were updated. This pushed cloudbees-folders (which was the failing dependency for Matrix Auth to 1.955. Jenkins also lists zero plugin updates at this time. Then when you jump forward there is a problem with the plugins loading because the dependency is now too low (I don’t understand why upgrading just Jenkins affects the plugin dependency, but it does and breaks it). So Jenkins won’t load and you cannot manage plugins.

To get this to work I had to jump through version 2.479.3 using sudo apt install jenkins=2.479.3 and update plugins in that version (Suddenly there are 134 plugin updates to apply in that version.) and then proceed on to 2.504.1 where there was just one other plugin to update.

It’s always hairy updating Jenkins. The experience is always “interesting”. I’m sure this is not the fault of the matrix auth plugin, but rather the plugin ecosystem as a whole.

Anyway, glad to be up and running again and also glad I put the first job for any Jenkins patching and upgrade procedure as creating a snapshot of the root disk first.

1 Like
10

Just a quick thank you!, we ran into exactly the same issue whilst attempting the same upgrade path, your upgrade strategy worked for us.

1 Like