jenkinsci / jenkinsci/credentials-plugin

Folder Scoped Credentials are not in the pulldown list

Open
#1,021 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
134
Forks
258
Avg merge
48m
Merged PRs (30d)
1

Description

### Jenkins and plugins versions report

Environment


```text
Jenkins: 2.541.1
OS: Linux - 5.15.0-112-generic
Java: 21.0.9 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)
---
ant:520.vd082ecfb_16a_9
antisamy-markup-formatter:173.v680e3a_b_69ff3
apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83
apache-httpcomponents-client-5-api:5.6-183.ve5a_8a_b_e71e59
artifactory:4.0.8
asm-api:9.9.1-189.vb_5ef2964da_91
authentication-tokens:1.144.v5ff4a_5ec5c33
authorize-project:2.0.0
azure-credentials:418.v6628eec6a_2c5
azure-keyvault:346.v75201ddefa_e0
azure-sdk:259.vf079c96088a_f
blueocean:1.27.25
blueocean-bitbucket-pipeline:1.27.25
blueocean-commons:1.27.25
blueocean-config:1.27.25
blueocean-core-js:1.27.25
blueocean-dashboard:1.27.25
blueocean-display-url:2.4.4
blueocean-events:1.27.25
blueocean-git-pipeline:1.27.25
blueocean-github-pipeline:1.27.25
blueocean-i18n:1.27.25
blueocean-jwt:1.27.25
blueocean-personalization:1.27.25
blueocean-pipeline-api-impl:1.27.25
blueocean-pipeline-editor:1.27.25
blueocean-pipeline-scm-api:1.27.25
blueocean-rest:1.27.25
blueocean-rest-impl:1.27.25
blueocean-web:1.27.25
bootstrap5-api:5.3.8-895.v4d0d8e47fea_d
bouncycastle-api:2.30.1.82-277.v70ca_0b_877184
branch-api:2.1280.v0d4e5b_b_460ef
build-name-setter:2.5.1
build-timeout:1.39
build-timestamp:1.1.1
build-user-vars-plugin:214.va_eed2ed849ca_
build-with-parameters:81.ve4a_9c2499d9a
caffeine-api:3.2.3-194.v31a_b_f7a_b_5a_81
categorized-view:197.v335f4625b_2e8
checks-api:402.vca_263b_f200e3
cloudbees-bitbucket-branch-source:937.2.4
cloudbees-disk-usage-simple:256.v20ec4eb_884f1
cloudbees-folder:6.1079.vc0975c2de294
command-launcher:123.v37cfdc92ef67
commons-collections4-api:4.5.0-8.va_d5448ef9011
commons-compress-api:1.28.0-3
commons-lang3-api:3.20.0-109.ve43756e2d2b_4
commons-text-api:1.15.0-210.v7480a_da_70b_9e
compact-columns:1.222.vcd19e64d7ef5
config-file-provider:1006.vc7366c201f57
configuration-as-code:2037.v8e5349845172
configuration-as-code-groovy:1.1
copyartifact:795.ve8e151429b_27
credentials:1490.ve7532596f1fd
credentials-binding:717.v951d49b_5f3a_a_
display-url-api:2.217.va_6b_de84cc74b_
durable-task:651.v1f5e074fc83f
echarts-api:6.0.0-1165.vd1283a_3e37d4
eddsa-api:0.3.0.1-29.v67e9a_1c969b_b_
email-ext:1933.v45cec755423f
envinject:2.934.vc674e76cf954
envinject-api:1.237.v82803a_511906
extra-columns:1.28
favorite:2.263.v941d21defef7
flatpickr-api:4.6.13-32.v60a_51029c136
font-awesome-api:7.1.0-882.v1dfb_771e3278
git:5.10.0
git-client:6.5.0
github:1.46.0
github-api:1.330-492.v3941a_032db_2a_
github-branch-source:1967.vdea_d580c1a_b_a_
gitlab-api:6.2.0-111.vf174d6b_8c12e
gitlab-branch-source:740.v04f287f9194d
gitlab-plugin:1.9.13
gradle:2.18.1203.v2c96b_1243c72
gson-api:2.13.2-173.va_a_092315913c
handy-uri-templates-2-api:2.1.8-38.vcea_5d521d5f3
htmlpublisher:427
instance-identity:203.v15e81a_1b_7a_38
ionicons-api:94.vcc3065403257
jackson2-api:2.20.1-423.v13951f6b_6532
jakarta-activation-api:2.1.4-1
jakarta-mail-api:2.1.5-1
jakarta-xml-bind-api:4.0.6-12.vb_1833c1231d3
javadoc:354.vee1a_660b_4990
javax-activation-api:1.2.0-8
javax-mail-api:1.6.2-11
jaxb:2.3.9-143.v5979df3304e6
jdk-tool:83.v417146707a_3d
jenkins-design-language:1.27.25
jersey2-api:2.47-165.ve7809a_3e87e0
jersey3-api:3.1.11-4.v77818819c2e1
jjwt-api:0.11.5-120.v0268cf544b_89
job-dsl:3654.vdf58f53e2d15
jobConfigHistory:1356.ve360da_6c523a_
joda-time-api:2.14.0-177.vd7e9347b_e7d5
jquery:1.12.4-3
jquery3-api:3.7.1-619.vdb_10e002501a_
jsch:0.2.16-95.v3eecb_55fa_b_78
json-api:20251224-185.v0cc18490c62c
json-path-api:2.10.0-202.va_9cc16c1e476
jsoup:1.22.1-76.v9cdb_2456c0e3
junit:1396.v095840ed8491
kubernetes:4423.vb_59f230b_ce53
kubernetes-client-api:7.3.1-256.v788a_0b_787114
kubernetes-credentials:207.v492f58828b_ed
locale:614.va_6a_5a_1a_f2b_38
mailer:525.v2458b_d8a_1a_71
matrix-auth:3.2.9
matrix-project:870.v9db_fcfc2f45b_
maven-plugin:3.27
metrics:4.2.37-494.v06f9a_939d33a_
mina-sshd-api-common:2.16.0-167.va_269f38cc024
mina-sshd-api-core:2.16.0-167.va_269f38cc024
nested-view:241.v178f0b_a_cd76a_
netty-api:4.1.130.Final-21.v5a_db_3eb_ea_034
next-executions:517.vc2c2ca_1b_c808
okhttp-api:4.12.0-195.vc02552c04ffd
opentelemetry:3.1573.v72f1a_711ca_98
opentelemetry-api:1.49.0.94.v5fc5325d5e7a_
oss-symbols-api:442.v99039087229b_
parameter-separator:334.v1fc0e534c71d
pipeline-build-step:584.vdb_a_2cc3a_d07a_
pipeline-graph-analysis:254.v0f63a_a_447dca_
pipeline-groovy-lib:787.ve2fef0efdca_6
pipeline-input-step:540.v14b_100d754dd
pipeline-milestone-step:138.v78ca_76831a_43
pipeline-model-api:2.2277.v00573e73ddf1
pipeline-model-definition:2.2277.v00573e73ddf1
pipeline-model-extensions:2.2277.v00573e73ddf1
pipeline-rest-api:2.39
pipeline-stage-step:322.vecffa_99f371c
pipeline-stage-tags-metadata:2.2277.v00573e73ddf1
pipeline-stage-view:2.39
pipeline-utility-steps:2.20.0
plain-credentials:199.v9f8e1f741799
plugin-util-api:6.1192.v30fe6e2837ff
prism-api:1.30.0-703.v116fb_3b_5b_b_a_a_
progress-bar-column-plugin:11.vdef198c2d6c1
project-description-setter:1.2
prometheus:852.v317db_5d17a_b_0
pubsub-light:1.19
rebuild:338.va_0a_b_50e29397
resource-disposer:0.25
role-strategy:848.va_a_ea_673cf0b_c
saferestart:102.v4dc1b_9636a_ee
saml:4.595.vec7523b_5d543
schedule-build:696.v0a_b_ec7334c89
scm-api:728.vc30dcf7a_0df5
script-security:1399.ve6a_66547f6e1
sectioned-view:1.30
snakeyaml-api:2.5-149.v72471e9c6371
sonar:2.18.2
sse-gateway:1.29
ssh-credentials:361.vb_f6760818e8c
sshd:3.384.vc89b_5e138cf9
structs:362.va_b_695ef4fdf9
swarm:3.51
throttle-concurrents:625.vc8b_e469e9a_b_c
timestamper:1.30
token-macro:477.vd4f0dc3cb_cf1
trilead-api:2.284.v1974ea_324382
uno-choice:2.8.9
validating-string-parameter:255.v31e2e6d0d273
variant:70.va_d9f17f859e0
workflow-aggregator:608.v67378e9d3db_1
workflow-api:1398.v67030756d3fb_
workflow-basic-steps:1098.v808b_fd7f8cf4
workflow-cps:4256.v991a_f1991c03
workflow-durable-task-step:1464.v2d3f5c68f84c
workflow-job:1571.vb_423c255d6d9
workflow-multibranch:821.vc3b_4ea_780798
workflow-scm-step:466.va_d69e602552b_
workflow-step-api:710.v3e456cc85233
workflow-support:1015.v785e5a_b_b_8b_22
ws-cleanup:0.49
```

Unable to get list of credentials to assign one to a job unless Job->Configure role is assigned. This used to work with just job build. Also, now need to add Credentials->create to allow them to create a credential (which I am ok with).

Giving Job->Configure is too much permission in our environment. We allow people to build infra using Jenkins and can assign a credential to use (this used to work on on Jenkins 2.504.1 with credentials:1415.v831096eb_5534 and role-strategy:777.v4fe2599cb_f48). Also could add and use user scoped as well, that no longer allows the user scoped credentials to be added here (need to do that on the user->Credentials).

### What Operating System are you using (both controller, and any agents involved in the problem)?

Linux container on kubernetes, current inbound agent container for java 21

### Reproduction steps

1. Create Job with `Credentials Parameter` (Testing with Username with password)
2. Run job and try and use folder scoped credentials. Won't list without Job->Configuration permissions

### Expected Results

Would be able to select the folder scoped credential from the pulldown list.

### Actual Results

List only had "-none-" entry

### Anything else?

_No response_

### Are you interested in contributing a fix?

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with a Credentials Parameter, a folder-scoped credential, and only Job->Build permission, comparing the reported Jenkins and plugin versions. Start at the Credentials Parameter flow and trace how the credential list is filtered by permissions. Done means the folder-scoped credential appears in the pulldown without granting Job->Configure, while existing permission boundaries remain intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authorization
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.