Credentials Binding Plugin

Is it possible to generate the credentials key from a regular choice or string parameter?

E.g. I have a job that does some database maintenance. It has a "Database" parameter which gives the user a choice of the database to work on. E.g "DB1", "DB2" etc

I'd like to be able to select the credentials to use based on the selected Database.E.g. to have credentials "DB1_Credentials", "DB2_Credentials" etc. The credentials to use would be identified by concatenating the Database with "_Credentials".

It looks at present like I'd have to add a matching credentials parameter and rely on the user selecting the one that matches their selected Database.

Hi,

When using the credentials-binding plugin to provide a build job with a username/password global credential pair, the password is exposed as plain text in the build log of the Jenkins job by executing the 'set' command using the 'Execute Windows batch command' build step type.

Is there a way of masking the password?

Thanks!

The Mask Passwords plugin has a security hole: Global passwords are masked in the console, but NOT masked if the job echo's it to a file, and the file is archived. You can see the clear-text password if you click the archive link under "Last Successful Artifacts".

Does the Credentials Binding Plugin protect passwords any better?

Hi, i have added credentials from user's section as i am using jenkins security. So the credentials added by admin in 'credentials' main screen are coming as dropdown list in job but the credentials added under 'user\configuration' are not listing in jobs drop down. Do i need to follow any different way to access credentials under 'user' ? I am using credentials@1.22 and credentailsBinding 1.4.

Cab you tell me how secure this is? Id like to store the credentials the application uses to connect to the database, then use them in the job to configure the database. But we could only use this in production if the credentials are encrypted

Whats the point of using the Credentials parameter option, of all it does it print out the UUID? What can that be used for?

The pipeline example could use an update. For example, it was not clear to me that you could bind multiple credentials in one call, and that you don't need the $class: 'SomeBinding' syntax anymore. The pipeline steps documentation is not so clear about this (doesn't document all symbols). The snippet generator does the right thing, but I'm not sure how many people would look there.

An example that could be used on this page

// Basic example
withCredentials([usernamePassword(credentialsId: 'amazon',
                     usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD')]) {
    //available as an env variable, but will be masked if you try to print it out any which way
    sh 'echo $PASSWORD'
    echo "${env.USERNAME}"
}

// You can also request multiple credentials in a single call
withCredentials([usernamePassword(credentialsId: 'amazon',
                     usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD'),
                 string(credentialsId: 'slack-url',
                     variable: 'SLACK_URL'),]) {
    sh 'echo $PASSWORD'
    echo "${env.SLACK_URL}"
}

// Older code might not use the new syntax (usernamePassword, string, ...) yet, and directly call the class:
withCredentials([[$class: 'UsernamePasswordMultiBinding', credentialsId: 'amazon',
                  usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD']]) {
    //available as an env variable, but will be masked if you try to print it out any which way
    sh 'echo $PASSWORD'
    echo "${env.USERNAME}"
}

Does this work on Windows? I installed the plugin, but cannot see an option to bind credentials in my pipeline.

Is there a way to disable or configure the password masking feature? This is causing a number of issues for us, as it seems that not only are passwords masked, but usernames as well. This causes commonly used words (such as "jenkins", "android", "artifactory", "admin", etc.) to appear as **** in our console output, as we have credentials with usernames like that. This causes a number of problems with our auditability.

I am getting error on saving my job. Job uses aws binding credentials:

org.kohsuke.stapler.WrongTypeException: Got type array but no lister class found for type class java.lang.String
...
Caused: java.lang.IllegalArgumentException: Failed to convert the credentialsId parameter of the constructor public com.cloudbees.jenkins.plugins.awscredentials.AmazonWebServicesCredentialsBinding(java.lang.String,java.lang.String,java.lang.String)
....
Caused: java.lang.IllegalArgumentException: Failed to instantiate class com.cloudbees.jenkins.plugins.awscredentials.AmazonWebServicesCredentialsBinding from {"accessKeyVariable":"AWS_ACCESS_KEY_ID","secretKeyVariable":"AWS_SECRET_ACCESS_KEY","credentialsId":["661501ac-9aa3-4402-9a11-54eef1fc0e7a",""],"stapler-class":"com.cloudbees.jenkins.plugins.awscredentials.AmazonWebServicesCredentialsBinding","$class":"com.cloudbees.jenkins.plugins.awscredentials.AmazonWebServicesCredentialsBinding"}
....
Caused: java.lang.Error: Failed to instantiate class com.cloudbees.jenkins.plugins.awscredentials.AmazonWebServicesCredentialsBinding from {"accessKeyVariable":"AWS_ACCESS_KEY_ID","secretKeyVariable":"AWS_SECRET_ACCESS_KEY","credentialsId":["661501ac-9aa3-4402-9a11-54eef1fc0e7a",""],"stapler-class":"com.cloudbees.jenkins.plugins.awscredentials.AmazonWebServicesCredentialsBinding","$class":"com.cloudbees.jenkins.plugins.awscredentials.AmazonWebServicesCredentialsBinding"}
...
Caused: javax.servlet.ServletException
....

Error screenshot in attachment.

I have observed that the Credentials section of job changes to CredentialsID. When i created it for the first time it had Credentials Description.
Has anyone faces issue like this before? This is bugging in for few hours by now.
What is the fix for this.

can you make this work before SCM? Or in combination with the 'preSCMbuildstep' and 'EnvInject' plugins?

Is it possible to globally bind credentials to a common environment variable?

Currently, if I want a credential injected to several jobs, I need to configure the binding in each job separately. 

It would be nice to be able to globally bind it to a variable (or more, if it's e.g. a username/password combo). 

I don't think it's a vulnerability, since you can do it anyway from within the jobs (assuming you have access to those jobs). 

Sine the last release of this (or in combination with other) plugins we have an issue that we get the following error when we use user own credentials, the same thing with Jenkins global passwords works without any problems:

org.jenkinsci.plugins.credentialsbinding.impl.CredentialNotFoundException: c5f0107c-13a7-4f59-a089-a3122131bb69

Is it possible, what here is a critical change in the plugin or is there maybe a conflict with other plugins?
We use Jenkins 2.89.4 and 2.107.2 in combination with 1.15 und 1.16. 
We are normally pretty up to date with the plugins.

It seems that user and password are not being masked on Blue Ocean UI.

It does get masked on pipeline.log but for the command bellow it will be shown on Blue Ocean UI:

withCredentials([usernamePassword(credentialsId: 'MYUSER', usernameVariable: 'USER', passwordVariable: 'PWD')]) {
bat "psexec -u ${USER} -p ${PWD} \\\\D1220001020A cmd /c \"del /q E:\test.txt\""
}

Password is exposed on UI to anyone with access to the project as it can be seen in image bellow:

Credentials Binding Plugin version 1.17

Jenkins ver. 2.138.3

How is the certificate credentials binding intended to work?
Having imported a certificate and added certificate binding to the job, there is no documentation on how to use the 3 fields:
Keystore Variable, Password Variable, Alias Variable