We have installed Jenkins 2.319.1 and running on the Master-Agent architecture. In this application, we are managing multiple teams to use our centralized Jenkins application.
Currently, we are facing below challenges w.r.t visibility of credentials as explained in the scenario:
When we are configuring a job under pipeline project and trying to use SCM as Git. Under Credentials, the logged-in user is able to see the list of all available user credentials under a drop-down list which should not be the case. It’s a security issue as multiple teams are involved here.
Kindly let us know how to restrict the credentials dropdown-list of other users to currently logged-in users i.e.,( Logged in users should be able to see their own credentials but not others).
As a reminder, the term “slave” to refer to an agent has been deprecated since 2016. Please refer to On Jenkins Terminology Updates for more details. We request you update your post.
Are you saying a given user can see other user’s credentials? if so please follow Reporting Security Vulnerabilities and report it to the security team.
If your saying you want only credentials attached to the user to show, then I’m not sure what is stopping you from doing that.
Gavin, I want to know the configuration steps to hide the other user’s credentials in the Dropdown under the SCM pipeline.
Please find the screenshot below where I am able to see all credentials which should not be the case.
One technique that I’ve seen has been to define the credentials on a folder and then block user access to that folder. It assures that only those with permission to access the folder can use the credentials that are defined on the folder.
That assumes you’ve defined your permissions with enough granularity that you can block specific users from specific folders.
There may be other ways, but that’s the one that I have seen most often.
