MFA exemptions for specific users/roles

[hexlianine]

Summary

Implement MFA exemptions to allow specific users and roles to bypass MFA verification. This feature is essential for service accounts, CI/CD agents, and emergency break-glass accounts that cannot complete interactive MFA.

#6 #5

Changes

New Features

• Exempt Users: Configure individual usernames to bypass MFA (case-insensitive matching)
• Exempt Roles: Configure role/group names to exempt all members from MFA
• Global Configuration UI: Add text areas in Manage Jenkins > Security > OpenMFA Configuration
• JCasC Support: Full Configuration as Code support for exemption lists

Files Added

• ExemptionService.java - Service for checking user/role exemptions
• ExemptionServiceTest.java - Unit tests for exemption logic
• MFAGlobalConfigurationTest.java - JCasC persistence tests
• help-exemptUsers.jelly - Help text for exempt users field
• help-exemptRoles.jelly - Help text for exempt roles field

Files Modified

• MFAGlobalConfiguration.java - Added exemptUsers and exemptRoles fields
• MFAFilter.java - Check exemptions before requiring MFA
• config.jelly - Added exemption configuration UI
• Messages.properties - Added English/Spanish/Chinese messages
• MFAFilterWebTest.java - Added integration tests
• README.md - Added documentation and examples

JCasC Example

security:
  openMFA:
    issuer: 'Jenkins'
    requireMFA: true
    exemptUsers:
      - svc-deploy
      - break-glass
    exemptRoles:
      - ci-agents
      - service-accounts

Testing

• Unit tests for ExemptionService (username/role matching)
• Integration tests for MFA filter bypass behavior
• JCasC persistence tests for configuration save/load
• All existing tests continue to pass

Security Notes

• Exempted users bypass MFA entirely - use sparingly
• Configuration requires admin privileges
• Exemption lists are auditable via Jenkins configuration