Credential Stores and Safe Binding

Scenario: One administrator token is globally available to every job and appears in a debug command line.

Pipeline example

withCredentials([string(credentialsId: 'lab-deploy-token', variable: 'TOKEN')]) { sh 'deploy < token.request' }

Stores, types, and scope

Jenkins credentials are typed records identified by a stable ID: secret text, username/password, SSH private key, certificate, and secret file are common types. System stores can expose globally scoped records; folder stores limit availability to that folder and descendants. Credential domains describe intended hosts or schemes but are matching hints, not a complete authorization wall. Prefer a separate service identity per purpose in the narrowest folder store.

WithCredentials converts records into temporary environment variables or files for a lexical block. Variables are restored afterward, and log masking recognizes many accidental renderings. Masking cannot defend against malicious Pipeline code, which can encode, archive, or transmit a secret. Use single-quoted Groovy shell commands so the shell expands variables; double-quoted Groovy interpolation may expose values in process arguments and Jenkins warnings.

Secret files and rotation

A file binding creates a temporary file. Binding from inside a workspace subdirectory can place that file beneath a browsable workspace path, so bind outside dir or allocate a separate ws. Disable shell tracing, avoid verbose HTTP output, and never archive environment dumps. Agents that receive credentials must have no untrusted co-tenants able to inspect processes or files.

Rotate the backing value while retaining its credential ID when consumers should move together, verify dependent jobs, then revoke the old identity. Inventory which jobs can bind an ID, not only who can view its masked representation. One global administrator token turns Configure permission on every eligible job into administrator authority in the external system.

Goal: Practice the concrete behavior in jenkins-credentials-binding. Learn sections have no Jenkins terminal; the Jenkins lab opens the real shared service in a new full-screen tab inside your private folder.