# What does mean to support folder scope credentials? **URL:** \ **Category:** Ask a question\ **Created:** [April 22, 2022, 9:54am UTC](https://community.jenkins.io/t/what-does-mean-to-support-folder-scope-credentials/2202 "2022-04-22T09:54:14Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ayushk048](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/ayushk048/32/1071_2.png) [@ayushk048](https://community.jenkins.io/u/ayushk048)\ **Post date:** [April 22, 2022, 9:54am UTC](https://community.jenkins.io/t/what-does-mean-to-support-folder-scope-credentials/2202/1 "2022-04-22T09:54:14Z")
```auto redentialsProvider.lookupCredentials( StringCredentials.class, Jenkins.get(), ACL.SYSTEM, Collections.emptyList()); ``` we have use this to get credentials from Jenkins plugin, they give us feed back that we have to support folder scope credentials ---
**Author:** ![kon](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/kon/32/1197_2.png) [@kon](https://community.jenkins.io/u/kon)\ **Post date:** [April 22, 2022, 2:41pm UTC](https://community.jenkins.io/t/what-does-mean-to-support-folder-scope-credentials/2202/2 "2022-04-22T14:41:20Z")
A user of Jenkins can define a folder and then an job in that folder. Or there can be a [ComputedFolder](https://javadoc.jenkins.io/plugin/cloudbees-folder/com/cloudbees/hudson/plugins/folder/computed/ComputedFolder.html), like a multibranch project that generates jobs for each branch in a version control system. If the user then adds credentials to the folder, those credentials should be available to the jobs that are in that same folder or in a child folder of it. This does not work with your code, which passes `Jenkins.get()` as the ItemGroup when it calls [lookupCredentials](https://javadoc.jenkins.io/plugin/credentials/com/cloudbees/plugins/credentials/CredentialsProvider.html#lookupCredentials-java.lang.Class-hudson.model.ItemGroup-org.acegisecurity.Authentication-java.util.List-). If you have a Run, you can call [Run.getParent()](https://javadoc.jenkins.io/hudson/model/Run.html#getParent--) to get a Job that you can then pass in as an Item to another overload of lookupCredentials. That way, lookupCredentials will be able to search for credentials in the correct folder. ---
**Author:** ![kon](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/kon/32/1197_2.png) [@kon](https://community.jenkins.io/u/kon)\ **Post date:** [April 23, 2022, 5:40am UTC](https://community.jenkins.io/t/what-does-mean-to-support-folder-scope-credentials/2202/3 "2022-04-23T05:40:39Z")
This seems to be about [Hosting request for plugin · Issue #2457 · jenkins-infra/repository-permissions-updater · GitHub](https://github.com/jenkins-infra/repository-permissions-updater/issues/2457) SecretRetriever is used in [redpen-jenkins-integration/RedpenJenkinsListener.java at 585e59e2dc997be93ae12486a0fdfe0e8fcb54e9 · AjmeraInfotech/redpen-jenkins-integration · GitHub](https://github.com/AjmeraInfotech/redpen-jenkins-integration/blob/585e59e2dc997be93ae12486a0fdfe0e8fcb54e9/src/main/java/org/jenkinsci/plugins/redpen/RedpenJenkinsListener.java#L43-L44) which has a Run and gets the credential ID from job properties. That could just use [findCredentialById(String id, Class\ type, Run\ run, List\ domainRequirements)](https://javadoc.jenkins.io/plugin/credentials/com/cloudbees/plugins/credentials/CredentialsProvider.html#findCredentialById-java.lang.String-java.lang.Class-hudson.model.Run-java.util.List-) instead of looping over the results of lookupCredentials and comparing credential IDs. See [Track usage of a credential against specific Jenkins context object](https://github.com/jenkinsci/credentials-plugin/blob/e05618c41e623cd974eef36b59e7c5bbda2a23c1/docs/consumer.adoc#track-usage-of-a-credential-against-specific-jenkins-context-objects) ---
**Author:** ![kon](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/kon/32/1197_2.png) [@kon](https://community.jenkins.io/u/kon)\ **Post date:** [April 23, 2022, 7:28am UTC](https://community.jenkins.io/t/what-does-mean-to-support-folder-scope-credentials/2202/4 "2022-04-23T07:28:58Z")
However, findCredentialById [uses the authorization of the Job](https://github.com/jenkinsci/credentials-plugin/blob/e05618c41e623cd974eef36b59e7c5bbda2a23c1/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java#L908) rather than ACL.SYSTEM, which you were using. This has two consequences if you start using findCredentialById: - You should also change the configuration UI so that it won’t let the user choose a credential that would cause an error later because the job is not authorized to use it. - Users have to configure the credentials such that jobs can access them. This will let pipeline jobs use credential binding to read the secrets, so people who can edit such pipelines can find out those secrets. If the credentials are generally defined by Jenkins administrators and have high access to [https://api.redpen.ai](https://api.redpen.ai) then maybe it’s a bad idea to force them to be disclosed to owners of pipelines in that way. ---
**Author:** ![jglick](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/jglick/32/77_2.png) [@jglick](https://community.jenkins.io/u/jglick)\ **Post date:** [November 1, 2022, 12:39pm UTC](https://community.jenkins.io/t/what-does-mean-to-support-folder-scope-credentials/2202/5 "2022-11-01T12:39:20Z")
If your code is running in the context of a build, it is better to use the methods which actually take `Run`. I think this has some impact when using user-scoped credentials, though I do not understand that clearly. It also means that you can use [OpenID Connect Provider](https://plugins.jenkins.io/oidc-provider/) to pass an id token with build-specific claims, for example.