Folder Scoped Credentials are not in the pulldown list

[bnfbiz]

Jenkins and plugins versions report

Environment

Jenkins: 2.541.1
OS: Linux - 5.15.0-112-generic
Java: 21.0.9 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)
---
ant:520.vd082ecfb_16a_9
antisamy-markup-formatter:173.v680e3a_b_69ff3
apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83
apache-httpcomponents-client-5-api:5.6-183.ve5a_8a_b_e71e59
artifactory:4.0.8
asm-api:9.9.1-189.vb_5ef2964da_91
authentication-tokens:1.144.v5ff4a_5ec5c33
authorize-project:2.0.0
azure-credentials:418.v6628eec6a_2c5
azure-keyvault:346.v75201ddefa_e0
azure-sdk:259.vf079c96088a_f
blueocean:1.27.25
blueocean-bitbucket-pipeline:1.27.25
blueocean-commons:1.27.25
blueocean-config:1.27.25
blueocean-core-js:1.27.25
blueocean-dashboard:1.27.25
blueocean-display-url:2.4.4
blueocean-events:1.27.25
blueocean-git-pipeline:1.27.25
blueocean-github-pipeline:1.27.25
blueocean-i18n:1.27.25
blueocean-jwt:1.27.25
blueocean-personalization:1.27.25
blueocean-pipeline-api-impl:1.27.25
blueocean-pipeline-editor:1.27.25
blueocean-pipeline-scm-api:1.27.25
blueocean-rest:1.27.25
blueocean-rest-impl:1.27.25
blueocean-web:1.27.25
bootstrap5-api:5.3.8-895.v4d0d8e47fea_d
bouncycastle-api:2.30.1.82-277.v70ca_0b_877184
branch-api:2.1280.v0d4e5b_b_460ef
build-name-setter:2.5.1
build-timeout:1.39
build-timestamp:1.1.1
build-user-vars-plugin:214.va_eed2ed849ca_
build-with-parameters:81.ve4a_9c2499d9a
caffeine-api:3.2.3-194.v31a_b_f7a_b_5a_81
categorized-view:197.v335f4625b_2e8
checks-api:402.vca_263b_f200e3
cloudbees-bitbucket-branch-source:937.2.4
cloudbees-disk-usage-simple:256.v20ec4eb_884f1
cloudbees-folder:6.1079.vc0975c2de294
command-launcher:123.v37cfdc92ef67
commons-collections4-api:4.5.0-8.va_d5448ef9011
commons-compress-api:1.28.0-3
commons-lang3-api:3.20.0-109.ve43756e2d2b_4
commons-text-api:1.15.0-210.v7480a_da_70b_9e
compact-columns:1.222.vcd19e64d7ef5
config-file-provider:1006.vc7366c201f57
configuration-as-code:2037.v8e5349845172
configuration-as-code-groovy:1.1
copyartifact:795.ve8e151429b_27
credentials:1490.ve7532596f1fd
credentials-binding:717.v951d49b_5f3a_a_
display-url-api:2.217.va_6b_de84cc74b_
durable-task:651.v1f5e074fc83f
echarts-api:6.0.0-1165.vd1283a_3e37d4
eddsa-api:0.3.0.1-29.v67e9a_1c969b_b_
email-ext:1933.v45cec755423f
envinject:2.934.vc674e76cf954
envinject-api:1.237.v82803a_511906
extra-columns:1.28
favorite:2.263.v941d21defef7
flatpickr-api:4.6.13-32.v60a_51029c136
font-awesome-api:7.1.0-882.v1dfb_771e3278
git:5.10.0
git-client:6.5.0
github:1.46.0
github-api:1.330-492.v3941a_032db_2a_
github-branch-source:1967.vdea_d580c1a_b_a_
gitlab-api:6.2.0-111.vf174d6b_8c12e
gitlab-branch-source:740.v04f287f9194d
gitlab-plugin:1.9.13
gradle:2.18.1203.v2c96b_1243c72
gson-api:2.13.2-173.va_a_092315913c
handy-uri-templates-2-api:2.1.8-38.vcea_5d521d5f3
htmlpublisher:427
instance-identity:203.v15e81a_1b_7a_38
ionicons-api:94.vcc3065403257
jackson2-api:2.20.1-423.v13951f6b_6532
jakarta-activation-api:2.1.4-1
jakarta-mail-api:2.1.5-1
jakarta-xml-bind-api:4.0.6-12.vb_1833c1231d3
javadoc:354.vee1a_660b_4990
javax-activation-api:1.2.0-8
javax-mail-api:1.6.2-11
jaxb:2.3.9-143.v5979df3304e6
jdk-tool:83.v417146707a_3d
jenkins-design-language:1.27.25
jersey2-api:2.47-165.ve7809a_3e87e0
jersey3-api:3.1.11-4.v77818819c2e1
jjwt-api:0.11.5-120.v0268cf544b_89
job-dsl:3654.vdf58f53e2d15
jobConfigHistory:1356.ve360da_6c523a_
joda-time-api:2.14.0-177.vd7e9347b_e7d5
jquery:1.12.4-3
jquery3-api:3.7.1-619.vdb_10e002501a_
jsch:0.2.16-95.v3eecb_55fa_b_78
json-api:20251224-185.v0cc18490c62c
json-path-api:2.10.0-202.va_9cc16c1e476
jsoup:1.22.1-76.v9cdb_2456c0e3
junit:1396.v095840ed8491
kubernetes:4423.vb_59f230b_ce53
kubernetes-client-api:7.3.1-256.v788a_0b_787114
kubernetes-credentials:207.v492f58828b_ed
locale:614.va_6a_5a_1a_f2b_38
mailer:525.v2458b_d8a_1a_71
matrix-auth:3.2.9
matrix-project:870.v9db_fcfc2f45b_
maven-plugin:3.27
metrics:4.2.37-494.v06f9a_939d33a_
mina-sshd-api-common:2.16.0-167.va_269f38cc024
mina-sshd-api-core:2.16.0-167.va_269f38cc024
nested-view:241.v178f0b_a_cd76a_
netty-api:4.1.130.Final-21.v5a_db_3eb_ea_034
next-executions:517.vc2c2ca_1b_c808
okhttp-api:4.12.0-195.vc02552c04ffd
opentelemetry:3.1573.v72f1a_711ca_98
opentelemetry-api:1.49.0.94.v5fc5325d5e7a_
oss-symbols-api:442.v99039087229b_
parameter-separator:334.v1fc0e534c71d
pipeline-build-step:584.vdb_a_2cc3a_d07a_
pipeline-graph-analysis:254.v0f63a_a_447dca_
pipeline-groovy-lib:787.ve2fef0efdca_6
pipeline-input-step:540.v14b_100d754dd
pipeline-milestone-step:138.v78ca_76831a_43
pipeline-model-api:2.2277.v00573e73ddf1
pipeline-model-definition:2.2277.v00573e73ddf1
pipeline-model-extensions:2.2277.v00573e73ddf1
pipeline-rest-api:2.39
pipeline-stage-step:322.vecffa_99f371c
pipeline-stage-tags-metadata:2.2277.v00573e73ddf1
pipeline-stage-view:2.39
pipeline-utility-steps:2.20.0
plain-credentials:199.v9f8e1f741799
plugin-util-api:6.1192.v30fe6e2837ff
prism-api:1.30.0-703.v116fb_3b_5b_b_a_a_
progress-bar-column-plugin:11.vdef198c2d6c1
project-description-setter:1.2
prometheus:852.v317db_5d17a_b_0
pubsub-light:1.19
rebuild:338.va_0a_b_50e29397
resource-disposer:0.25
role-strategy:848.va_a_ea_673cf0b_c
saferestart:102.v4dc1b_9636a_ee
saml:4.595.vec7523b_5d543
schedule-build:696.v0a_b_ec7334c89
scm-api:728.vc30dcf7a_0df5
script-security:1399.ve6a_66547f6e1
sectioned-view:1.30
snakeyaml-api:2.5-149.v72471e9c6371
sonar:2.18.2
sse-gateway:1.29
ssh-credentials:361.vb_f6760818e8c
sshd:3.384.vc89b_5e138cf9
structs:362.va_b_695ef4fdf9
swarm:3.51
throttle-concurrents:625.vc8b_e469e9a_b_c
timestamper:1.30
token-macro:477.vd4f0dc3cb_cf1
trilead-api:2.284.v1974ea_324382
uno-choice:2.8.9
validating-string-parameter:255.v31e2e6d0d273
variant:70.va_d9f17f859e0
workflow-aggregator:608.v67378e9d3db_1
workflow-api:1398.v67030756d3fb_
workflow-basic-steps:1098.v808b_fd7f8cf4
workflow-cps:4256.v991a_f1991c03
workflow-durable-task-step:1464.v2d3f5c68f84c
workflow-job:1571.vb_423c255d6d9
workflow-multibranch:821.vc3b_4ea_780798
workflow-scm-step:466.va_d69e602552b_
workflow-step-api:710.v3e456cc85233
workflow-support:1015.v785e5a_b_b_8b_22
ws-cleanup:0.49

Unable to get list of credentials to assign one to a job unless Job->Configure role is assigned. This used to work with just job build. Also, now need to add Credentials->create to allow them to create a credential (which I am ok with).

Giving Job->Configure is too much permission in our environment. We allow people to build infra using Jenkins and can assign a credential to use (this used to work on on Jenkins 2.504.1 with credentials:1415.v831096eb_5534 and role-strategy:777.v4fe2599cb_f48). Also could add and use user scoped as well, that no longer allows the user scoped credentials to be added here (need to do that on the user->Credentials).

What Operating System are you using (both controller, and any agents involved in the problem)?

Linux container on kubernetes, current inbound agent container for java 21

Reproduction steps

1. Create Job with Credentials Parameter (Testing with Username with password)
2. Run job and try and use folder scoped credentials. Won't list without Job->Configuration permissions

Expected Results

Would be able to select the folder scoped credential from the pulldown list.

Actual Results

List only had "-none-" entry

Anything else?

No response

Are you interested in contributing a fix?

No response

[timja]

Can you provide more steps or information?

I created a credential in the folder of type username / pasword.

Created a freestyle job with a credentials parameter.
Clicked build with parameters
The credential shows in the dropdown:

[bnfbiz]

@timja The account that I was trying to use the credentials with had less permissions. Here are more complete steps (let me know if anything was missed in this).

As Jenkins Administrator

1. Create TestFolder
2. Create TestJob

3. Create role based on the permission template:

Note: In the old system we didn't need to give the Credentials permissions not sure why

4. Assign role to user (not shown)

As testuser with role defined above

1. Build with Parameters the TestJob
2. Select + Add for the credential field (NOte on the old system user scoped shows up as well

3. Add folder scoped credential:

4. Attempt to select the credential:

5. Since it is not available check the folder scoped credential link (under TestFolder) and see the role exists.

[timja]

Interesting, thanks I've reproduced it.

I had to add overall/read as a global role and job/read on the permission template to make it work on top of what you provided.

[bnfbiz]

For some reason the job read wasn't on in the document above, sorry about that it should have been. The user does have overall read and credentials view.

[timja]

Its a bit weird that it requires configure permissions.

Here's the code:

credentials-plugin/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java

Lines 150 to 153 in 54bfc32

	public static final Permission USE_ITEM = new Permission(GROUP, "UseItem",
	Messages._CredentialsProvider_UseItemPermissionDescription(), Job.CONFIGURE,
	Boolean.getBoolean("com.cloudbees.plugins.credentials.UseItemPermission"),
	new PermissionScope[]{PermissionScope.ITEM});

There's a more fine-grained option Credentials/UseItem but its not enabled by default - I think lesser used permissions are disabled as the UI doesn't handle many permissions well.

You can enable it in the script console to test with:

com.cloudbees.plugins.credentials.CredentialsProvider.USE_ITEM.enabled = true

or on startup by setting the system property: -Dcom.cloudbees.plugins.credentials.UseItemPermission=true

---

I've tested and Credentials/UseItem works fine.

[bnfbiz]

@timja sorry for the delay in testing, I was finally able to get around to testing and the fine-grained access control worked. Was this change by design or a bug in the updates to the plugin?

[timja]

By design - not changed in a long time if at all

[bnfbiz]

@timja I still feel like something changed as stated above our old site has folder scoped credentials: (Note user scoped shows up here as well)

I did check the use item setting:

This was in 2.504.1 as mentioned above

[timja]

Its possible but as far as I can tell that setting is required.