From 2daaf47dde3d32cd4aae664fab569d57e16e1e3b Mon Sep 17 00:00:00 2001 From: Nikolas Falco Date: Fri, 1 Mar 2024 15:54:59 +0100 Subject: [PATCH] [JENKINS-58902] Non-user-scoped credentials are not shown when build authentication is configured Fix CredentialProvider to gather system credentials when users have USE_ITEM USE_OWN permission. --- .../credentials/CredentialsProvider.java | 21 +++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java b/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java index 8afe42deb..e0e68991b 100644 --- a/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java +++ b/src/main/java/com/cloudbees/plugins/credentials/CredentialsProvider.java @@ -560,7 +560,15 @@ public static List lookupCredentialsInItem(@NonNull C for (CredentialsProvider provider : all()) { if (provider.isEnabled(item) && provider.isApplicable(type)) { try { - for (C c: provider.getCredentialsInItem(type, item, authentication, domainRequirements)) { + List credentials = provider.getCredentialsInItem(type, item, authentication, domainRequirements); + // also lookup credentials as SYSTEM if granted for this item + if (authentication != ACL.SYSTEM2 + && (item.getACL().hasPermission2(authentication, CredentialsProvider.USE_ITEM) + || item.getACL().hasPermission2(authentication, CredentialsProvider.USE_OWN))) { + credentials.addAll(provider.getCredentialsInItem(type, item, ACL.SYSTEM2, domainRequirements)); + } + + for (C c: credentials) { if (!(c instanceof IdCredentials) || ids.add(((IdCredentials) c).getId())) { // if IdCredentials, only add if we haven't added already // if not IdCredentials, always add @@ -633,9 +641,14 @@ public static ListBoxModel listCredentialsInItem(@NonN for (CredentialsProvider provider : all()) { if (provider.isEnabled(item) && provider.isApplicable(type)) { try { - for (ListBoxModel.Option option : provider.getCredentialIdsInItem( - type, item, authentication, domainRequirements, matcher == null ? CredentialsMatchers.always() : matcher) - ) { + ListBoxModel credentialIds = provider.getCredentialIdsInItem(type, item, authentication, domainRequirements, matcher); + // also lookup credentials with scope SYSTEM when user has grants for this item + if (authentication != ACL.SYSTEM2 + && (item.getACL().hasPermission2(authentication, CredentialsProvider.USE_ITEM) + || item.getACL().hasPermission2(authentication, CredentialsProvider.USE_OWN))) { + credentialIds.addAll(provider.getCredentialIdsInItem(type, item, ACL.SYSTEM2, domainRequirements, matcher)); + } + for (ListBoxModel.Option option : credentialIds) { if (ids.add(option.value)) { result.add(option); }