Jenkins and GitHub webhook: HTTP 403

From Github's instructions ("Configuring global authentication", the first section),

1. Create a user in Jenkins which has, at a minimum, Job/Build permissions

2. Log in as that user (this is required even if you are a Jenkins admin user), then click on the user's name in the top right corner of the page

3. Click 'Configure,' then 'Show API Token...', and note/copy the User ID and API Token.

4. In GitLab, when you create webhooks to trigger Jenkins jobs, use this format for the URL and do not enter anything for 'Secret Token': http://USERID:APITOKEN@JENKINS_URL/project/YOUR_JOB

In my case I used http://USERID:APITOKEN@myIPaddress:808/ and no project/YOUR_JOB

https://username:[email protected]/github-webhook/ worked for me but the password has to be encoded for the payload to work. My github was not able to contact jenkins due to nginx authorisation but passing username and encoded password worked!

As I don't allow anonymous access, it turns out I needed to create a specific user for GitHub pushes and to grant it Overall read, Job create and Job read. It was also necessary to bundle the authentication into the webhook URL, like so:

https://foo:[email protected]/github-webhook/

As previously mentioned Jenkins does not allow anonymous access (you don't want people to trigger builds for you!). Adding a username and password in the clear is not the best solution.

1) If your Jenkins is behind a VPN, you need to make sure that your Jenkins webhooks URL are exposed

2) In the GitHub plugin configuration add the correct accessible Jenkins webhook URL(https://jenkins.example.com/github-webhook/) in Override Hook URL

3) Add a secret in the Shared secret section (preferably a long random string). This would be a token sent from Jenkins to GitHub and vice versa for authentication. This should be different from the GitHub Server Credentials!

4) Make sure the user has owner access to add webhooks to your GitHub repos

5) Don't forget to re-register the webhooks after this