In Hudson, User objects are created in on-demand basis; for example, when a build is performed, its change log is computed and as a result commits from users who Hudson has never seen may be discovered. When this happens, new User object is created.
If the persisted record for an user exists, the information is loaded at that point, but if there's no such record, a fresh instance is created from thin air (this is where UserPropertyDescriptor.newInstance(User) is called to provide initial UserProperty objects.
Jenkins now refuses to let the user login if he/she doesn't exist in SecurityRealm, which was necessary to make sure users removed from the backend will get removed from the frontend.
Jenkins historically created a (usually) ephemeral user record when an user with Overall/Administer permission accesses a /user/arbitraryName URL.
Updates the user object by adding a property.
With ADMINISTER permission, can delete users with persisted data but can't delete self.
Gets the User object representing the currently logged-in user, or null if the current user is anonymous.
Deletes the data directory and removes this user from Hudson.
Deletes this user from Hudson.
This method is deprecated, because it causes unexpected User creation by API usage code and causes performance degradation of used to retrieve users by ID. Use getById(java.lang.String, boolean) when you know you have an ID. Otherwise use getOrCreateByIdOrFullName(String) or get(String, boolean, Map).
Gets the User object by its id or full name.
The URL of the user page.
List of all UserPropertys exposed primarily for the remoting API.
Checks for authorities (groups) associated with this user.
Gets the list of Builds that include changes by this user, by the timestamp order.
Gets the human readable name of this user.
Get the user by ID or Full Name.
Gets all the AbstractProjects that this user has committed to.
Gets the user properties configured for this user.
Gets the specific property, or null.
Return all properties that are also actions.
Return all transient actions associated with this user.
Gets the fallback "unknown" user instance.
This method checks with SecurityRealm if the user is a valid user that can login to the security realm.
Returns the folder that store all the user information.
Returns the IdStrategy for use with User instances.
Creates an Authentication object that represents this user.
Is the ID allowed? Some are prohibited for security reasons.
Called when changing the IdStrategy.
To be called from Jenkins.reload() only.
Sets the description of the user.
Sets the human readable name of the user.
Unfortunately this infringed some legitimate use cases of creating Jenkins-local users for automation purposes. This escape hatch switch can be enabled to resurrect that behaviour.
Unfortunately this constitutes a CSRF vulnerability, as malicious users can make admins create arbitrary numbers of ephemeral user records, so the behavior was changed in Jenkins 2.TODO / 2.32.2.
As some users may be relying on the previous behavior, setting this to true restores the previous behavior. This is not recommended.
the IdStrategy for use with User instances.
Gets the human readable name of this user. This is configurable by the user.
Sets the human readable name of the user. If the input parameter is empty, the user's ID will be set.
This method checks with SecurityRealm if the user is a valid user that can login to the security realm. If SecurityRealm is a kind that does not support querying information about other users, this will use LastGrantedAuthoritiesProperty to pick up the granted authorities as of the last time the user has logged in.
org.acegisecurity.userdetails.UsernameNotFoundException - If this user is not a valid user in the backend SecurityRealm.
userDetails - Provided by getUserDetailsForImpersonation().
This is used to avoid null User instance.
create - If true, this method will never return null for valid input (by creating a new User object if none exists.) If false, this method will return null if User object with the given name doesn't exist.
Requested user. May be null if a user does not exist and create is false.
In order to resolve the user ID, the method invokes User.CanonicalIdResolver extension points. Note that it may cause significant performance degradation. If you are sure the passed value is a User ID, it is recommended to use getById(String, boolean).
An existing or created user. May be null if a user does not exist and create is false.
Deprecated. This method is deprecated, because it causes unexpected User creation by API usage code and causes performance degradation of used to retrieve users by ID. Use getById(java.lang.String, boolean) when you know you have an ID. Otherwise use getOrCreateByIdOrFullName(String) or get(String, boolean, Map).
Use getById(java.lang.String, boolean) when you know you have an ID. In this method Jenkins will try to resolve the User by full name with help of various UserNameResolver. This is slow (see JENKINS-23281).
If the user does not exist, creates a new one on-demand.
User instance. It will be created on-demand.
a - the supplied Authentication .
id - the id of the user to retrieve and optionally create if it does not exist.
create - If true, this method will never return null for valid input (by creating a new User object if none exists.) If false, this method will return null if User object with the given id doesn't exist.
the a User whose id is id, or null if create is false and the user does not exist.
Called by tests in the JTH. Otherwise this shouldn't be called. Even in the tests this usage is questionable.
Returns the folder that store all the user information. Useful for plugins to save a user-specific file aside the config.xml. Exposes implementation details that may be subject to change.
The folder containing the user configuration files or null if the user was not yet saved.
Is the ID allowed? Some are prohibited for security reasons. See SECURITY-166.
Note that this is only enforced when saving. These users are often created via the constructor (and even listed on /asynchPeople), but our goal is to prevent anyone from logging in as these users. Therefore, we prevent saving a User with one of these ids.
true if the username or fullname is valid. For null or blank IDs returns false.
IOException - if we fail to delete.
Checks for authorities (groups) associated with this user. If the caller lacks Jenkins.ADMINISTER, or any problems arise, returns an empty list. SecurityRealm.AUTHENTICATED_AUTHORITY and the username, if present, are omitted.
the list can be empty but never null. read only.