[JENKINS-59626] Global configuration page blocks may try to load credentials before credentials providers are ready

The Jenkins global configuration (/configure) page currently suffers from a chicken-and-egg load order problem between plugins that consume credentials (e.g. Docker plugin) and plugins that provide credentials (e.g. AWS Secrets Manager provider).

Preconditions

• The configuration block for the consuming plugin, and the configuration block for the providing plugin, are displayed at the same time.


• The providing plugin has not been configured yet.


• The providing plugin is a remote provider, and as such is contractually bound to throw an unchecked exception when it is uninitialised or otherwise cannot contact its backing store.

Bug

When the uninitialised remote provider is asked to provide credentials, the exception it throws will crash the /configure page (or part of it).

Effects

• Jenkins users will see a (partially) broken /configure page. (But if they can use Configuration As Code, they can get round this.)


• Plugin integration tests exercising the /configure page will break. (HtmlUnit and the Ajax controller will fail when they detect the page has crashed. There is no workaround for this.)

---
Originally reported by chriskilding, imported from: Global configuration page blocks may try to load credentials before credentials providers are ready

• status: Open
  
• priority: Major
  
• component(s): credentials-plugin
  
• label(s): configuration, credentials
  
• resolution: Unresolved
  
• votes: 2
  
• watchers: 3
  
• imported: 2025-12-08
  

Raw content of original issue

The Jenkins global configuration (/configure) page currently suffers from a chicken-and-egg load order problem between plugins that consume credentials (e.g. Docker plugin) and plugins that provide credentials (e.g. AWS Secrets Manager provider).


Preconditions




	
The configuration block for the consuming plugin, and the configuration block for the providing plugin, are displayed at the same time.

	
The providing plugin has not been configured yet.

	
The providing plugin is a remote provider, and as such is contractually bound to throw an unchecked exception when it is uninitialised or otherwise cannot contact its backing store.



Bug


When the uninitialised remote provider is asked to provide credentials, the exception it throws will crash the /configure page (or part of it).


Effects




	
Jenkins users will see a (partially) broken /configure page. (But if they can use Configuration As Code, they can get round this.)

	
Plugin integration tests exercising the /configure page will break. (HtmlUnit and the Ajax controller will fail when they detect the page has crashed. There is no workaround for this.)

Start at the Jenkins /configure page and reproduce the failure with a consuming plugin such as Docker and an unconfigured remote provider such as AWS Secrets Manager. Check the HtmlUnit and Ajax controller integration paths mentioned in the issue; done means the configuration page remains usable and those integration checks no longer fail when the provider is unavailable.

Written by the indexing model from the issue text.