[JIRA] (JENKINS-60329) Username/password credentials can not be used with git

peter@peterfich.com (JIRA)

unread,

Nov 29, 2019, 6:34:03 AM11/29/19

to jenkinsc...@googlegroups.com

Peter Fich created an issue

Jenkins /

JENKINS-60329

Username/password credentials can not be used with git

Issue Type:	Bug
Assignee:	Chris Kilding
Components:	aws-secrets-manager-credentials-provider-plugin
Created:	2019-11-29 11:33
Priority:	Minor
Reporter:	Peter Fich

I'm trying to use username/password credentials with git in a pipeline like this:

 
                                                                pipeline {
  agent any
  stages {
    stage('Example') {
      steps {
        git credentialsId: 'git-creds', url:'https://github.com/jenkinsci/aws-secrets-manager-credentials-provider-plugin.git'
      }
    }
  }
} 
                                                            

The Git plugin will first test if the credentials are a ssh key, and then try to extract the key. Only if the credentials are not a ssh key will it test if it is a username/password.

The issue is that 'AwsCredentials' are implementing both 'StandardUsernamePasswordCredentials' and 'SSHUserPrivateKey'.

The solution would be (I think) to have different subclasses for each.

Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)

chris+jenkins@chriskilding.com (JIRA)

unread,

Dec 6, 2019, 11:10:03 AM12/6/19

to jenkinsc...@googlegroups.com

Chris Kilding commented on

JENKINS-60329

Re: Username/password credentials can not be used with git

Hi Peter, I have added a failing test that reproduces the issue in a GitHub PR to get us started.

Add Comment

chris+jenkins@chriskilding.com (JIRA)

unread,

Dec 17, 2019, 6:28:03 AM12/17/19

to jenkinsc...@googlegroups.com

Chris Kilding commented on

JENKINS-60329

Re: Username/password credentials can not be used with git

The options for fixing this appear (to me at least) to be:

Fix the naive credential type detection in the Git plugin.
Push type detection up the chain in the credentials provider, so that by the time we instantiate the primary credential object, we already know the exact type. This eliminates the multi-type object.
Decompose the multi-type object and return a single type object in the credential snapshot taker (this is a fragile solution: it would fix the Git plugin because it just so happens to snapshot credentials, but it doesn’t generalise to plugins that use credentials directly).

Add Comment

chris+jenkins@chriskilding.com (JIRA)

unread,

Dec 17, 2019, 6:30:02 AM12/17/19

to jenkinsc...@googlegroups.com

Chris Kilding commented on

JENKINS-60329

Re: Username/password credentials can not be used with git

When I looked at option 3 - get creative with the credential snapshot taker - I found it has very strict type constraints, so I don’t think it is viable to change the returned credential type within the snapshot taker.