[JENKINS-53806] Class-based DomainSpecification filter for more flexibility of restricting credentials

User Story

As an admin of Jenkins, I would like the flexibility to restrict how credentials are accessed based on the class type of the caller requesting the credential so that I can flexibly restrict credentials without the need to add new scopes.

Acceptance Criteria

• Verify that arbitrary classes can be selected for restricting. (e.g. hudson.model.Item)

Additional Information

This will likely require at least 3 new classes (I'm not completely sure):

• ClassnameSpecification extending from DomainSpecification.java


• ClassnameRequirement extending from DomainRequirement.java


• Perhaps a ClassnameMatcher which implements CredentialsMatcher.java (I'm really not sure about this)

I would like the configuration of the DomainSpecification to be similar to how the job restrictions plugin allows configuration of restricting by class. See the following screenshot:

---
Originally reported by sag47, imported from: Class-based DomainSpecification filter for more flexibility of restricting credentials

• status: Open
  
• priority: Minor
  
• component(s): credentials-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 2025-12-08
  

Raw content of original issue

User Story


As an admin of Jenkins, I would like the flexibility to restrict how credentials are accessed based on the class type of the caller requesting the credential so that I can flexibly restrict credentials without the need to add new scopes.


Acceptance Criteria




	
Verify that arbitrary classes can be selected for restricting.  (e.g. hudson.model.Item)



Additional Information


This will likely require at least 3 new classes (I'm not completely sure):




	
ClassnameSpecification extending from DomainSpecification.java

	
ClassnameRequirement extending from DomainRequirement.java

	
Perhaps a ClassnameMatcher which implements CredentialsMatcher.java (I'm really not sure about this)



I would like the configuration of the DomainSpecification to be similar to how the job restrictions plugin allows configuration of restricting by class.  See the following screenshot:


  

1 attachment

- [screenshot-job-restrictions-plugin-config.png](https://issues.jenkins.io/secure/attachment/44608/screenshot-job-restrictions-plugin-config.png)
> 

Start by reading src/main/java/com/cloudbees/plugins/credentials/domains/DomainSpecification.java and DomainRequirement.java, then inspect CredentialsMatcher.java. Compare the requested configuration with the job restrictions plugin example and determine the necessary class-based restriction design. Done means arbitrary classes such as hudson.model.Item can be selected and credential access is restricted accordingly.

Written by the indexing model from the issue text.