After updating plugin role strategy plugin, jenkins is not working

Question

I'm using jenkins 2.138.1. And I have updated role-based strategy in "manage plugin" section and tried to restart the instance using jenkinsurl/restart. It is throwing below error and now no login screen is visible:

com.thoughtworks.xstream.mapper.CannotResolveClassException: com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategyat com.thoughtworks.xstream.mapper.DefaultMapper.realClass(DefaultMapper.java:79)atcom.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.DynamicProxyMapper.realClass(DynamicProxyMapper.java:55)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.PackageAliasingMapper.realClass(PackageAliasingMapper.java:88)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.ClassAliasingMapper.realClass(ClassAliasingMapper.java:79)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.ArrayMapper.realClass(ArrayMapper.java:74)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.SecurityMapper.realClass(SecurityMapper.java:71)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at hudson.util.XStream2$CompatibilityMapper.realClass(XStream2.java:379)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at org.jenkinsci.jruby.JRubyMapper.realClass(JRubyMapper.java:34)
        at hudson.util.xstream.MapperDelegate.realClass(MapperDelegate.java:43)
        at com.thoughtworks.xstream.mapper.MapperWrapper.realClass(MapperWrapper.java:30)
        at com.thoughtworks.xstream.mapper.CachingMapper.realClass(CachingMapper.java:48)
        at hudson.util.RobustReflectionConverter.determineType(RobustReflectionConverter.java:461)
        at hudson.util.RobustReflectionConverter.doUnmarshal(RobustReflectionConverter.java:327)
    Caused: jenkins.util.xstream.CriticalXStreamException: com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy : com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy
    ---- Debugging information ----
    message             : com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy
    cause-exception     : com.thoughtworks.xstream.mapper.CannotResolveClassException
    cause-message       : com.michelin.cio.hudson.plugins.rolestrategy.RoleBasedAuthorizationStrategy
    class               : hudson.model.Hudson
    required-type       : hudson.model.Hudson
    converter-type      : hudson.util.RobustReflectionConverter
    path                : /hudson/authorizationStrategy
    line number         : 11
    version             : not available
    -------------------------------
        at hudson.util.RobustReflectionConverter.doUnmarshal(RobustReflectionConverter.java:356)
        at hudson.util.RobustReflectionConverter.unmarshal(RobustReflectionConverter.java:270)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convert(TreeUnmarshaller.java:72)
        at com.thoughtworks.xstream.core.AbstractReferenceUnmarshaller.convert(AbstractReferenceUnmarshaller.java:65)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:66)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.convertAnother(TreeUnmarshaller.java:50)
        at com.thoughtworks.xstream.core.TreeUnmarshaller.start(TreeUnmarshaller.java:134)
        at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.unmarshal(AbstractTreeMarshallingStrategy.java:32)
        at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1189)
        at hudson.util.XStream2.unmarshal(XStream2.java:161)
        at hudson.util.XStream2.unmarshal(XStream2.java:132)
        at com.thoughtworks.xstream.XStream.unmarshal(XStream.java:1173)
        at hudson.XmlFile.unmarshal(XmlFile.java:178)
    Caused: java.io.IOException: Unable to read /var/lib/jenkins/config.xml
        at hudson.XmlFile.unmarshal(XmlFile.java:181)
        at hudson.XmlFile.unmarshal(XmlFile.java:161)
        at jenkins.model.Jenkins.loadConfig(Jenkins.java:3005)
        at jenkins.model.Jenkins.access$1300(Jenkins.java:304)
        at jenkins.model.Jenkins$13.run(Jenkins.java:3104)
        at org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:169)
        at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:296)
        at jenkins.model.Jenkins$5.runTask(Jenkins.java:1066)
        at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:214)
        at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:117)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
        at java.lang.Thread.run(Thread.java:748)
    Caused: org.jvnet.hudson.reactor.ReactorException
        at org.jvnet.hudson.reactor.Reactor.execute(Reactor.java:282)
        at jenkins.InitReactorRunner.run(InitReactorRunner.java:48)
        at jenkins.model.Jenkins.executeReactor(Jenkins.java:1100)
        at jenkins.model.Jenkins.<init>(Jenkins.java:904)
        at hudson.model.Hudson.<init>(Hudson.java:85)
        at hudson.model.Hudson.<init>(Hudson.java:81)
        at hudson.WebAppMain$3.run(WebAppMain.java:233)
    Caused: hudson.util.HudsonFailedToLoad
        at hudson.WebAppMain$3.run(WebAppMain.java:250)

Answer 1

Had the same problem, solved this way:

I closed the jenkins url as this makes it usable but everybody becomes admin

Backed up the config.xml as it will be blanked out.

In $JENKINS_HOME/config.xml commented out/removed all the authorizationStrategy block and changed <useSecurity>true</useSecurity> to false.

Started jenkins (it started back normally but without authentication.

Changed the config.xml to previous original version (included all security previously running) and worked back normally with the original role strategy configuration in place.

Answer 2

I had this error today, in my case was an issue of dependencies, the Role-based Authorization Strategy was updated to v3.0 and I updated the plugins with Ansible jenkins_job module and Jenkins failed after restart. Error from browser was similar to this, I got this error from server:

2020-06-10 20:02:24.483+0000 [id=29]    SEVERE  jenkins.InitReactorRunner$1#onTaskFailed: Failed Loading plugin Role-based Authorization Strategy v3.0 (role-strategy)
java.io.IOException: Failed to load: Role-based Authorization Strategy (3.0)
 - Plugin is missing: extended-read-permission (3.2)
        at hudson.PluginWrapper.resolvePluginDependencies(PluginWrapper.java:933)
        at hudson.PluginManager$2$1$1.run(PluginManager.java:546)
        at org.jvnet.hudson.reactor.TaskGraphBuilder$TaskImpl.run(TaskGraphBuilder.java:169)
        at org.jvnet.hudson.reactor.Reactor.runTask(Reactor.java:296)
        at jenkins.model.Jenkins$5.runTask(Jenkins.java:1133)
        at org.jvnet.hudson.reactor.Reactor$2.run(Reactor.java:214)
        at org.jvnet.hudson.reactor.Reactor$Node.run(Reactor.java:117)
        at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:59)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.base/java.lang.Thread.run(Thread.java:834)

As you see, there is a pending plugin, seems that Ansible can update plugins from dependencies as required, but not install newer dependencies.

After setting similar solution, making backup of config.xml, removing security, installing dependency Extended Read Permission and then restoring config I was able to restore the service.