Today the folders plugin provides an access control layer over its own local credentials provider. This works, but it means that if a user wants to restrict access to a particular credential by folder, they cannot store it in their preferred provider: instead they must copy it into the FolderCredentialsProvider.

I would like to extend the plugin so that it can provide its access control layer (ACL) over any credentials provider.

Benefits

• Only write the access control logic once. Today, other providers would have to copy-paste the intricate ACL logic from the folders plugin, and then keep that up to date with any changes. Mistakes will inevitably be made.
• It works the same way everywhere. Folders-based ACL will not have provider-specific behaviour, or a provider-specific storage schema for the ACL.
• ACL can be written in JCasC YAML. Each folder entry just needs to have a list of allowed credential IDs.
• Single Responsibility Principle. Providers do one thing: store and retrieve credentials. Folders plugin does one thing (for credentials): run the ACL over the providers.

Tasks

TODO convert these to sub-tasks

• Design JCasC YAML schema for the ACL
• Design Web UI for the ACL
• Decide on default behaviour when folders plugin is present, a job accesses a credential, but no restrictions are configured for that credential:
  • Default allow? (Treat it as a global credential)
  • Default deny? (Don't ask, don't get)
• Make ACL work with other folder types (GitHub/Bitbucket Organization Folders)
• Deprecate/remove legacy bits of CredentialsProvider / CredentialsStore API that were meant to be used for access control (since it would not be their job any more)
• Ensure ease of use with infrastructure tools like Terraform (it should be as simple as possible to have Terraform define Secrets Manager secrets, then interpolate the relevant IDs into the JCasC YAML).