Kerberos machine/service principals that may authenticate, one pattern per line. A principal whose local part contains / or ends in $ is eligible to be matched, including host/fqdn@REALM, HTTP/server@REALM and NAME$@REALM. Eligibility alone admits nothing. A principal matching no pattern uses the security realm's user lookup as before, so leaving this empty changes nothing and an instance name such as alice/admin@REALM still resolves as that person. A denied principal is the exception: it stays anonymous instead of falling back to the realm.

Patterns match the whole principal case-insensitively. * is the only wildcard and is allowed only before @; name one nonempty, literal realm. Prefix a pattern with ! to deny it. Denial wins regardless of order and applies on the next negotiated request, including one carrying a cookie; it does not stop work already running.

Allow patterns may grant comma-separated groups after ->, for example host/ci*@EXAMPLE.COM -> ci-servers, Production. Matching groups are combined, preserving their case, and every admitted machine also gets kerberos-machines. Deny patterns cannot grant groups. authenticated is reserved and cannot be granted. The identity is the lowercased full principal. Existing grants to that name or its groups apply.

Use explicit user/group authorization, such as Matrix Authorization. Do not use machine access with “Logged-in users can do anything” or a strategy that trusts every non-anonymous identity: omitting the authenticated authority does not restrict it. For a build callback, grant the group global Overall/Read and only the target job's Job/Read and Job/Build. Other or anonymous grants may also apply.

Disable Allow anonymous access for machine API calls. Each protected request must use Kerberos; login cookies do not retain machine authentication. POST requests using Jenkins' default CSRF protection still need a crumb and its session cookie. Bypassed and unprotected paths, including /whoAmI, do not negotiate. See the README for a complete example.

Authentication itself does not create or save a Jenkins user record; other Jenkins features or plugins may do so. Treat machine identities as low trust: local administrators can use their host's credentials. Grant only what the automation requires.