[JENKINS-60897] JEP-225: Folders-based access control for any credentials provider

Today the folders plugin provides an access control layer over its own local credentials provider. This works, but it means that if a user wants to restrict access to a particular credential by folder, they cannot store it in their preferred provider: instead they must copy it into the FolderCredentialsProvider.

I would like to extend the plugin so that it can provide its access control layer (ACL) over any credentials provider.

Benefits

• Only write the access control logic once. Today, other providers would have to copy-paste the intricate ACL logic from the folders plugin, and then keep that up to date with any changes. Mistakes will inevitably be made.


• It works the same way everywhere. Folders-based ACL will not have provider-specific behaviour, or a provider-specific storage schema for the ACL.


• ACL can be written in JCasC YAML. Each folder entry just needs to have a list of allowed credential IDs.


• Single Responsibility Principle. Providers do one thing: store and retrieve credentials. Folders plugin does one thing (for credentials): run the ACL over the providers.

Tasks

TODO convert these to sub-tasks

• Design JCasC YAML schema for the ACL


• Design Web UI for the ACL


• Decide on default behaviour when folders plugin is present, a job accesses a credential, but no restrictions are configured for that credential:
  
  
  
  • Default allow? (Treat it as a global credential)
  
  
  • Default deny? (Don't ask, don't get)
  
  
  
  


• Make ACL work with other folder types (GitHub/Bitbucket Organization Folders)


• Deprecate/remove legacy bits of CredentialsProvider / CredentialsStore API that were meant to be used for access control (since it would not be their job any more)


• Ensure ease of use with infrastructure tools like Terraform (it should be as simple as possible to have Terraform define Secrets Manager secrets, then interpolate the relevant IDs into the JCasC YAML).

---
Originally reported by chriskilding, imported from: JEP-225: Folders-based access control for any credentials provider

• assignee: chriskilding
  
• status: Open
  
• priority: Minor
  
• component(s): cloudbees-folder-plugin, credentials-plugin
  
• label(s): JEP-225
  
• resolution: Unresolved
  
• votes: 7
  
• watchers: 9
  
• imported: 2025-12-08
  

Today the folders plugin provides an access control layer over its own local credentials provider. This works, but it means that if a user wants to restrict access to a particular credential by folder, they cannot store it in their preferred provider: instead they must copy it into the FolderCredentialsProvider.


I would like to extend the plugin so that it can provide its access control layer (ACL) over any credentials provider.

Benefits



	
Only write the access control logic once. Today, other providers would have to copy-paste the intricate ACL logic from the folders plugin, and then keep that up to date with any changes. Mistakes will inevitably be made.

	
It works the same way everywhere. Folders-based ACL will not have provider-specific behaviour, or a provider-specific storage schema for the ACL.

	
ACL can be written in JCasC YAML. Each folder entry just needs to have a list of allowed credential IDs.

	
Single Responsibility Principle. Providers do one thing: store and retrieve credentials. Folders plugin does one thing (for credentials): run the ACL over the providers.



Tasks


TODO convert these to sub-tasks



	
Design JCasC YAML schema for the ACL

	
Design Web UI for the ACL

	
Decide on default behaviour when folders plugin is present, a job accesses a credential, but no restrictions are configured for that credential:

	


		
Default allow? (Treat it as a global credential)

		
Default deny? (Don't ask, don't get)

	

	

	
Make ACL work with other folder types (GitHub/Bitbucket Organization Folders)

	
Deprecate/remove legacy bits of CredentialsProvider / CredentialsStore API that were meant to be used for access control (since it would not be their job any more)

	
Ensure ease of use with infrastructure tools like Terraform (it should be as simple as possible to have Terraform define Secrets Manager secrets, then interpolate the relevant IDs into the JCasC YAML).

This is a JEP-225 design epic spanning the credentials-plugin and cloudbees-folder-plugin; no implementation files or tests are named. Start by resolving the JCasC schema, Web UI, default allow/deny behavior, and support for other folder types. Done requires an agreed design and implementation plan for applying folder ACLs to any credentials provider.

Written by the indexing model from the issue text.