Hi, thanks a lot! Yeah, to be honest, I now use only groups and I can specify them in the DSL like users. But I use configure block, so I can specify something like this (in my case it’s Authorization Matrix compatible with Azure AD, but schema is exactly the same for classic AM, it’s just another class):

configure {
it / ‘properties’ / ‘com.microsoft.jenkins.azuread.AzureAdAuthorizationMatrixProperty’ {
inheritanceStrategy(class: ‘org.jenkinsci.plugins.matrixauth.inheritance.InheritGlobalStrategy’)
permission(‘hudson.model.Item.Read:username’)
permission(‘hudson.model.Item.Read:groupname’)
}
}
And it works perfectly.

In the XML code I can specify as
USER:hudson.model.Item.Configure:deployuser
GROUP:hudson.model.Item.Read:anonymous

Is there a way to specify it in the DSL:

pipelineJob(‘__job_name__’) {
authorization {
blocksInheritance()
permission(‘hudson.model.Item.Configure’,deployuser’)
permission(‘hudson.model.Item.Read:anonymous’)
}

There is an comment in https://stackoverflow.com/questions/70454192/jenkins-ambiguous-permission which answers my question but not sure how to implement it.
Thanks.

What do you exactly mean? You can update permissions by DSL and manually, at the project level in the configuration of the project, or globally – inside the Security section of Jenkins configuration. Does it answer your question?