com.cloudbees.plugins.credentials

Class CredentialsProvider

java.lang.Object

com.cloudbees.plugins.credentials.CredentialsProvider

All Implemented Interfaces:

hudson.ExtensionPoint

Direct Known Subclasses:

SystemCredentialsProvider.ProviderImpl, UserCredentialsProvider

public abstract class CredentialsProvider
extends Object
implements hudson.ExtensionPoint

An extension point for providing Credentials.

Nested Class Summary

Nested classes/interfaces inherited from interface hudson.ExtensionPoint

hudson.ExtensionPoint.LegacyInstancesAreScopedToHudson

Field Summary

Fields

Modifier and Type	Field and Description
static hudson.security.Permission	CREATE The permission for adding credentials to a CredentialsStore.
static hudson.security.Permission	DELETE The permission for removing credentials from a CredentialsStore.
static hudson.security.PermissionGroup	GROUP The permission group for credentials.
static hudson.security.Permission	MANAGE_DOMAINS The permission for managing credential domains in a CredentialsStore.
static hudson.security.Permission	UPDATE The permission for updating credentials in a CredentialsStore.
static hudson.security.Permission	USE_ITEM Where an immediate action against a job requires that a credential be selected by the user triggering the action, this permission allows the user to select a credential from those credentials available within the scope of the job.
static hudson.security.Permission	USE_OWN Where an immediate action against a job requires that a credential be selected by the user triggering the action, this permission allows the user to select a credential from their private credential store.
static hudson.security.Permission	VIEW The permission for viewing credentials in a CredentialsStore.

Constructor Summary

Constructors

Constructor and Description
CredentialsProvider()

Method Summary

Methods

Modifier and Type	Method and Description
static hudson.DescriptorExtensionList<Credentials,hudson.model.Descriptor<Credentials>>	allCredentialsDescriptors() Returns all the registered Credentials descriptors.
static <C extends IdCredentials> C	findCredentialById(String id, Class<C> type, hudson.model.Run<?,?> run, DomainRequirement... domainRequirements) A common requirement for plugins is to resolve a specific credential by id in the context of a specific run.
static <C extends IdCredentials> C	findCredentialById(String id, Class<C> type, hudson.model.Run<?,?> run, List<DomainRequirement> domainRequirements) A common requirement for plugins is to resolve a specific credential by id in the context of a specific run.
<C extends Credentials> List<C>	getCredentials(Class<C> type, hudson.model.Item item, org.acegisecurity.Authentication authentication) Returns the credentials provided by this provider which are available to the specified Authentication for the specified Item
<C extends Credentials> List<C>	getCredentials(Class<C> type, hudson.model.Item item, org.acegisecurity.Authentication authentication, List<DomainRequirement> domainRequirements) Returns the credentials provided by this provider which are available to the specified Authentication for items in the specified Item and are appropriate for the specified .credentials.domains.DomainRequirements.
abstract <C extends Credentials> List<C>	getCredentials(Class<C> type, hudson.model.ItemGroup itemGroup, org.acegisecurity.Authentication authentication) Returns the credentials provided by this provider which are available to the specified Authentication for items in the specified ItemGroup
<C extends Credentials> List<C>	getCredentials(Class<C> type, hudson.model.ItemGroup itemGroup, org.acegisecurity.Authentication authentication, List<DomainRequirement> domainRequirements) Returns the credentials provided by this provider which are available to the specified Authentication for items in the specified ItemGroup and are appropriate for the specified .plugins.credentials.domains.DomainRequirements.
Set<CredentialsScope>	getScopes(hudson.model.ModelObject object) Returns the scopes allowed for credentials stored within the specified object or null if the object is not relevant for scopes and the object's container should be considered instead.
CredentialsStore	getStore(hudson.model.ModelObject object) Returns the CredentialsStore that this CredentialsProvider maintains specifically for this ModelObject or null if either the object is not a credentials container or this CredentialsProvider does not maintain a store specifically bound to this ModelObject.
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type) Deprecated. use lookupCredentials(Class, Item, Authentication, List), lookupCredentials(Class, Item, Authentication, DomainRequirement...), lookupCredentials(Class, ItemGroup, Authentication, List) or lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, org.acegisecurity.Authentication authentication) Deprecated. use lookupCredentials(Class, Item, Authentication, List), lookupCredentials(Class, Item, Authentication, DomainRequirement...), lookupCredentials(Class, ItemGroup, Authentication, List) or lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, hudson.model.Item item) Deprecated. use lookupCredentials(Class, Item, Authentication, List) or lookupCredentials(Class, Item, Authentication, DomainRequirement...)
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, hudson.model.Item item, org.acegisecurity.Authentication authentication) Deprecated. use lookupCredentials(Class, Item, Authentication, List) or lookupCredentials(Class, Item, Authentication, DomainRequirement...)
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, hudson.model.Item item, org.acegisecurity.Authentication authentication, DomainRequirement... domainRequirements) Returns all credentials which are available to the specified Authentication for use by the specified Item.
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, hudson.model.Item item, org.acegisecurity.Authentication authentication, List<DomainRequirement> domainRequirements) Returns all credentials which are available to the specified Authentication for use by the specified Item.
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, hudson.model.ItemGroup itemGroup) Deprecated. use lookupCredentials(Class, ItemGroup, Authentication, List) or lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, hudson.model.ItemGroup itemGroup, org.acegisecurity.Authentication authentication) Deprecated. use lookupCredentials(Class, ItemGroup, Authentication, List) or lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, hudson.model.ItemGroup itemGroup, org.acegisecurity.Authentication authentication, DomainRequirement... domainRequirements) Returns all credentials which are available to the specified Authentication for use by the Items in the specified ItemGroup.
static <C extends Credentials> List<C>	lookupCredentials(Class<C> type, hudson.model.ItemGroup itemGroup, org.acegisecurity.Authentication authentication, List<DomainRequirement> domainRequirements) Returns all credentials which are available to the specified Authentication for use by the Items in the specified ItemGroup.
static Set<CredentialsScope>	lookupScopes(hudson.model.ModelObject object) Returns the scopes allowed for credentials stored within the specified object or null if the object is not relevant for scopes and the object's container should be considered instead.
static Iterable<CredentialsStore>	lookupStores(hudson.model.ModelObject object) Returns a lazy Iterable of all the CredentialsStore instances contributing credentials to the supplied object.
static <C extends Credentials> C	snapshot(C credential) Make a best effort to ensure that the supplied credential is a snapshot credential (i.e.
static <C extends Credentials> C	snapshot(Class<C> clazz, C credential) Make a best effort to ensure that the supplied credential is a snapshot credential (i.e.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

GROUP

public static final hudson.security.PermissionGroup GROUP

The permission group for credentials.

Since:

1.8

CREATE

public static final hudson.security.Permission CREATE

The permission for adding credentials to a CredentialsStore.

Since:

1.8

UPDATE

public static final hudson.security.Permission UPDATE

The permission for updating credentials in a CredentialsStore.

Since:

1.8

VIEW

public static final hudson.security.Permission VIEW

The permission for viewing credentials in a CredentialsStore.

Since:

1.8

DELETE

public static final hudson.security.Permission DELETE

The permission for removing credentials from a CredentialsStore.

Since:

1.8

MANAGE_DOMAINS

public static final hudson.security.Permission MANAGE_DOMAINS

The permission for managing credential domains in a CredentialsStore.

Since:

1.8

USE_OWN

public static final hudson.security.Permission USE_OWN

Where an immediate action against a job requires that a credential be selected by the user triggering the action, this permission allows the user to select a credential from their private credential store. Immediate actions could include: building with parameters, tagging a build, deploying artifacts, etc.

Since:

1.16

USE_ITEM

public static final hudson.security.Permission USE_ITEM

Where an immediate action against a job requires that a credential be selected by the user triggering the action, this permission allows the user to select a credential from those credentials available within the scope of the job. Immediate actions could include: building with parameters, tagging a build, deploying artifacts, etc. This permission is implied by Item.CONFIGURE as anyone who can configure the job can configure the job to use credentials within the item scope anyway.

Since:

1.16

Constructor Detail

CredentialsProvider

public CredentialsProvider()

Method Detail

allCredentialsDescriptors

public static hudson.DescriptorExtensionList<Credentials,hudson.model.Descriptor<Credentials>> allCredentialsDescriptors()

Returns all the registered Credentials descriptors.

Returns:

all the registered Credentials descriptors.

getScopes

public Set<CredentialsScope> getScopes(hudson.model.ModelObject object)

Returns the scopes allowed for credentials stored within the specified object or null if the object is not relevant for scopes and the object's container should be considered instead.

Parameters:

object - the object.

Returns:

the set of scopes that are relevant for the object or null if the object is not a credentials container.

getStore

@CheckForNull
public CredentialsStore getStore(@CheckForNull
                                     hudson.model.ModelObject object)

Returns the CredentialsStore that this CredentialsProvider maintains specifically for this ModelObject or null if either the object is not a credentials container or this CredentialsProvider does not maintain a store specifically bound to this ModelObject.

Parameters:

object - the Item or ItemGroup or User that the store is being requested of.

Returns:

either null or a scoped CredentialsStore where CredentialsStore.getContext() == object.

Since:

1.8

getCredentials

@NonNull
public abstract <C extends Credentials> List<C> getCredentials(@NonNull
                                                     Class<C> type,
                                                     @Nullable
                                                     hudson.model.ItemGroup itemGroup,
                                                     @Nullable
                                                     org.acegisecurity.Authentication authentication)

Returns the credentials provided by this provider which are available to the specified Authentication for items in the specified ItemGroup

Parameters:

type - the type of credentials to return.

itemGroup - the item group (if null assume Hudson.getInstance().

authentication - the authentication (if null assume ACL.SYSTEM.

Returns:

the list of credentials.

getCredentials

@NonNull
public <C extends Credentials> List<C> getCredentials(@NonNull
                                                     Class<C> type,
                                                     @Nullable
                                                     hudson.model.ItemGroup itemGroup,
                                                     @Nullable
                                                     org.acegisecurity.Authentication authentication,
                                                     @NonNull
                                                     List<DomainRequirement> domainRequirements)

Returns the credentials provided by this provider which are available to the specified Authentication for items in the specified ItemGroup and are appropriate for the specified .plugins.credentials.domains.DomainRequirements.

Parameters:

type - the type of credentials to return.

itemGroup - the item group (if null assume Hudson.getInstance().

authentication - the authentication (if null assume ACL.SYSTEM.

domainRequirements - the credential domains to match (if the CredentialsProvider does not support DomainRequirements then it should assume the match is true).

Returns:

the list of credentials.

Since:

1.5

getCredentials

@NonNull
public <C extends Credentials> List<C> getCredentials(@NonNull
                                                     Class<C> type,
                                                     @NonNull
                                                     hudson.model.Item item,
                                                     @Nullable
                                                     org.acegisecurity.Authentication authentication)

Returns the credentials provided by this provider which are available to the specified Authentication for the specified Item

Parameters:

type - the type of credentials to return.

item - the item.

authentication - the authentication (if null assume ACL.SYSTEM.

Returns:

the list of credentials.

getCredentials

@NonNull
public <C extends Credentials> List<C> getCredentials(@NonNull
                                                     Class<C> type,
                                                     @NonNull
                                                     hudson.model.Item item,
                                                     @Nullable
                                                     org.acegisecurity.Authentication authentication,
                                                     @NonNull
                                                     List<DomainRequirement> domainRequirements)

Returns the credentials provided by this provider which are available to the specified Authentication for items in the specified Item and are appropriate for the specified .credentials.domains.DomainRequirements.

Parameters:

type - the type of credentials to return.

item - the item.

authentication - the authentication (if null assume ACL.SYSTEM.

domainRequirements - the credential domain to match.

Returns:

the list of credentials.

Since:

1.5

lookupCredentials

@Deprecated
@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                                   Class<C> type)

Deprecated. use lookupCredentials(Class, Item, Authentication, List), lookupCredentials(Class, Item, Authentication, DomainRequirement...), lookupCredentials(Class, ItemGroup, Authentication, List) or lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)

Returns all credentials which are available to the ACL.SYSTEM Authentication within the Hudson.getInstance().

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

Returns:

the list of credentials.

lookupCredentials

@Deprecated
@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                                   Class<C> type,
                                                                   @Nullable
                                                                   org.acegisecurity.Authentication authentication)

Deprecated. use lookupCredentials(Class, Item, Authentication, List), lookupCredentials(Class, Item, Authentication, DomainRequirement...), lookupCredentials(Class, ItemGroup, Authentication, List) or lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)

Returns all credentials which are available to the specified Authentication within the Hudson.getInstance().

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

authentication - the authentication.

Returns:

the list of credentials.

lookupCredentials

@Deprecated
@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                                   Class<C> type,
                                                                   @Nullable
                                                                   hudson.model.Item item)

Deprecated. use lookupCredentials(Class, Item, Authentication, List) or lookupCredentials(Class, Item, Authentication, DomainRequirement...)

Returns all credentials which are available to the ACL.SYSTEM Authentication for use by the specified Item.

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

item - the item.

Returns:

the list of credentials.

lookupCredentials

@Deprecated
@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                                   Class<C> type,
                                                                   @Nullable
                                                                   hudson.model.ItemGroup itemGroup)

Deprecated. use lookupCredentials(Class, ItemGroup, Authentication, List) or lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)

Returns all credentials which are available to the ACL.SYSTEM Authentication for use by the Items in the specified ItemGroup.

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

itemGroup - the item group.

Returns:

the list of credentials.

lookupCredentials

@Deprecated
@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                                   Class<C> type,
                                                                   @Nullable
                                                                   hudson.model.ItemGroup itemGroup,
                                                                   @Nullable
                                                                   org.acegisecurity.Authentication authentication)

Deprecated. use lookupCredentials(Class, ItemGroup, Authentication, List) or lookupCredentials(Class, ItemGroup, Authentication, DomainRequirement...)

Returns all credentials which are available to the specified Authentication for use by the Items in the specified ItemGroup.

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

itemGroup - the item group.

authentication - the authentication.

Returns:

the list of credentials.

lookupCredentials

@Deprecated
@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                                   Class<C> type,
                                                                   @Nullable
                                                                   hudson.model.Item item,
                                                                   @Nullable
                                                                   org.acegisecurity.Authentication authentication)

Deprecated. use lookupCredentials(Class, Item, Authentication, List) or lookupCredentials(Class, Item, Authentication, DomainRequirement...)

Returns all credentials which are available to the specified Authentication for use by the specified Item.

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

authentication - the authentication.

item - the item.

Returns:

the list of credentials.

lookupCredentials

@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                        Class<C> type,
                                                        @Nullable
                                                        hudson.model.ItemGroup itemGroup,
                                                        @Nullable
                                                        org.acegisecurity.Authentication authentication,
                                                        @Nullable
                                                        DomainRequirement... domainRequirements)

Returns all credentials which are available to the specified Authentication for use by the Items in the specified ItemGroup.

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

itemGroup - the item group.

authentication - the authentication.

domainRequirements - the credential domains to match.

Returns:

the list of credentials.

Since:

1.5

lookupCredentials

@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                        Class<C> type,
                                                        @Nullable
                                                        hudson.model.ItemGroup itemGroup,
                                                        @Nullable
                                                        org.acegisecurity.Authentication authentication,
                                                        @Nullable
                                                        List<DomainRequirement> domainRequirements)

Returns all credentials which are available to the specified Authentication for use by the Items in the specified ItemGroup.

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

itemGroup - the item group.

authentication - the authentication.

domainRequirements - the credential domains to match.

Returns:

the list of credentials.

Since:

1.5

lookupCredentials

@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                        Class<C> type,
                                                        @Nullable
                                                        hudson.model.Item item,
                                                        @Nullable
                                                        org.acegisecurity.Authentication authentication,
                                                        DomainRequirement... domainRequirements)

Returns all credentials which are available to the specified Authentication for use by the specified Item.

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

authentication - the authentication.

item - the item.

domainRequirements - the credential domains to match.

Returns:

the list of credentials.

Since:

1.5

lookupCredentials

@NonNull
public static <C extends Credentials> List<C> lookupCredentials(@NonNull
                                                        Class<C> type,
                                                        @Nullable
                                                        hudson.model.Item item,
                                                        @Nullable
                                                        org.acegisecurity.Authentication authentication,
                                                        @Nullable
                                                        List<DomainRequirement> domainRequirements)

Returns all credentials which are available to the specified Authentication for use by the specified Item.

Type Parameters:

C - the credentials type.

Parameters:

type - the type of credentials to get.

authentication - the authentication.

item - the item.

domainRequirements - the credential domains to match.

Returns:

the list of credentials.

Since:

1.5

lookupScopes

@CheckForNull
public static Set<CredentialsScope> lookupScopes(hudson.model.ModelObject object)

Returns the scopes allowed for credentials stored within the specified object or null if the object is not relevant for scopes and the object's container should be considered instead.

Parameters:

object - the object.

Returns:

the set of scopes that are relevant for the object or null if the object is not a credentials container.

lookupStores

public static Iterable<CredentialsStore> lookupStores(hudson.model.ModelObject object)

Returns a lazy Iterable of all the CredentialsStore instances contributing credentials to the supplied object.

Parameters:

object - the Item or ItemGroup or User to get the CredentialsStores of.

Returns:

a lazy Iterable of all CredentialsStore instances.

Since:

1.8

snapshot

public static <C extends Credentials> C snapshot(C credential)

Make a best effort to ensure that the supplied credential is a snapshot credential (i.e. self-contained and does not reference any external stores). WARNING: May produce unusual results if presented an exotic credential that implements multiple distinct credential types at the same time, e.g. a credential that is simultaneously a TLS certificate and a SSH key pair and a GPG key pair all at the same time... unless the author of that credential type also provides a CredentialsSnapshotTaker that can handle such a tripple play.

Type Parameters:

C - the type of credential.

Parameters:

credential - the credential.

Returns:

the credential or a snapshot of the credential.

Since:

1.14

snapshot

public static <C extends Credentials> C snapshot(Class<C> clazz,
                                 C credential)

Make a best effort to ensure that the supplied credential is a snapshot credential (i.e. self-contained and does not reference any external stores)

Type Parameters:

C - the type of credential.

Parameters:

clazz - the type of credential that we are trying to snapshot (specified so that if there is more than one type of snapshot able credential interface implemented by the credentials, then they can be separated out.

credential - the credential.

Returns:

the credential or a snapshot of the credential.

Since:

1.14

findCredentialById

@CheckForNull
public static <C extends IdCredentials> C findCredentialById(@NonNull
                                                          String id,
                                                          @NonNull
                                                          Class<C> type,
                                                          @NonNull
                                                          hudson.model.Run<?,?> run,
                                                          DomainRequirement... domainRequirements)

A common requirement for plugins is to resolve a specific credential by id in the context of a specific run. Given that the credential itself could be resulting from a build parameter expression and the complexities of determining the scope of items from which the credential should be resolved in a chain of builds, this method provides the correct answer.

Parameters:

id - either the id of the credential to find or a parameter expression for the id.

type - the type of credential to find.

run - the Run defining the context within which to find the credential.

domainRequirements - the domain requirements of the credential.

Returns:

the credential or null if either the credential cannot be found or the user triggering the run is not permitted to use the credential in the context of the run.

Since:

1.16

findCredentialById

@CheckForNull
public static <C extends IdCredentials> C findCredentialById(@NonNull
                                                          String id,
                                                          @NonNull
                                                          Class<C> type,
                                                          @NonNull
                                                          hudson.model.Run<?,?> run,
                                                          @Nullable
                                                          List<DomainRequirement> domainRequirements)

A common requirement for plugins is to resolve a specific credential by id in the context of a specific run. Given that the credential itself could be resulting from a build parameter expression and the complexities of determining the scope of items from which the credential should be resolved in a chain of builds, this method provides the correct answer.

Parameters:

id - either the id of the credential to find or a parameter expression for the id.

type - the type of credential to find.

run - the Run defining the context within which to find the credential.

domainRequirements - the domain requirements of the credential.

Returns:

the credential or null if either the credential cannot be found or the user triggering the run is not permitted to use the credential in the context of the run.

Since:

1.16