Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-70835

Last credentialsBinding usernamePassword overrides the others instead of adding to list

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • None
    • Jenkins 2.387.1
      Job DSL 1.82
      Credentials Binding Plugin 523.vd859a_4b_122e6

      When defining multiple usernamePassword pairs to be set from credentials only the last one is actually configured in the job.

       

      wrappers {
          credentialsBinding {
              usernamePassword("USER1", "PASS1", "credential1")
              usernamePassword("USER2", "PASS2", "credential2")
          }
      }
      

      Since the UI when manually configuring a job offers the ability to add multiple items I would expect all of them to be configured in the job, not just the last one.

          [JENKINS-70835] Last credentialsBinding usernamePassword overrides the others instead of adding to list

          Vanio Begic added a comment -

          Note that in this case I would expect the block to be called credentialBindings (plural) instead of credentialBinding (singular). That would mean breakage of API, thus I would recommend adding another block instead of changing the behavior of existing block if that is possible.

           

          Also this sound like a good candidate for first  issue. If that is the case I would like to lend a hand and start working on this one.

          Vanio Begic added a comment - Note that in this case I would expect the block to be called  credentialBindings (plural) instead of  credentialBinding (singular). That would mean breakage of API, thus I would recommend adding another block instead of changing the behavior of existing block if that is possible.   Also this sound like a good candidate for first  issue. If that is the case I would like to lend a hand and start working on this one.

          Vanio Begic added a comment -

          I am unable to reproduce this issue:

           

          job('example') {
              wrappers {
                credentialsBinding {
                    usernamePassword("USER1", "PASS1", "credential1")
                    usernamePassword("USER2", "PASS2", "credential2")
                }
              }
          } 

           

          This configuration resulted in an example job being created with expected credentials:

           

           

           

          I would vote to close this issue

          Vanio Begic added a comment - I am unable to reproduce this issue:   job( 'example' ) {     wrappers {       credentialsBinding {           usernamePassword( "USER1" , "PASS1" , "credential1" )           usernamePassword( "USER2" , "PASS2" , "credential2" )       }     } }   This configuration resulted in an example job being created with expected credentials:       I would vote to close this issue

          Looking at the config history of the job that originally prompted me to create this issue it looks like the Job-DSL went from (state before adding the second credential)
           

                   wrappers {
                       sshAgent(gitCredentialId)
                       colorizeOutput()
                        credentialsBinding {
                            usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")
                        }
                        environmentVariables {
                            env("REDMINE_URL", "https://issues.redacted")
                            env("RUST_LOG", "info")
                        }
                   }
           

          which generated

              <buildWrappers>
                  <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
                      <user>website_git</user>
                  </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
                  <hudson.plugins.ansicolor.AnsiColorBuildWrapper>
                      <colorMapName>xterm</colorMapName>
                  </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
                  <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
                      <bindings>
                          <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                              <credentialsId>redmine_api</credentialsId>
                              <usernameVariable>REDMINE_USER</usernameVariable>
                              <passwordVariable>REDMINE_API_KEY</passwordVariable>
                          </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                      </bindings>
                  </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
                  <EnvInjectBuildWrapper>
                      <info>
                          <propertiesContent>REDMINE_URL=https://issues.redacted
          RUST_LOG=info</propertiesContent>
                          <loadFilesFromMaster>false</loadFilesFromMaster>
                      </info>
                  </EnvInjectBuildWrapper>
              </buildWrappers>
          

          to (first attempt to add the second credential)

                   wrappers {
                       sshAgent(gitCredentialId)
                       colorizeOutput()
                        credentialsBinding {
                            usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")
                        }
                        environmentVariables {
                            env("REDMINE_URL", "https://issues.redacted")
                            env("RUST_LOG", "info")
                        }
                        if(job.containsKey("elts_credentials")) {
                            credentialsBinding {
                            usernamePassword("ELTS_USER", "ELTS_TOKEN", job["elts_credentials"])
                       }
                   }
          

          which generated

              <buildWrappers>
                  <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
                      <user>website_git</user>
                  </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
                  <hudson.plugins.ansicolor.AnsiColorBuildWrapper>
                      <colorMapName>xterm</colorMapName>
                  </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
                  <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
                      <bindings>
                          <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                              <credentialsId>redmine_api</credentialsId>
                              <usernameVariable>REDMINE_USER</usernameVariable>
                              <passwordVariable>REDMINE_API_KEY</passwordVariable>
                          </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                      </bindings>
                  </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
                  <EnvInjectBuildWrapper>
                      <info>
                          <propertiesContent>REDMINE_URL=https://issues.redacted
          RUST_LOG=info</propertiesContent>
                          <loadFilesFromMaster>false</loadFilesFromMaster>
                      </info>
                  </EnvInjectBuildWrapper>
                  <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
                      <bindings>
                          <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                              <credentialsId>typo3_elts_9_5</credentialsId>
                              <usernameVariable>ELTS_USER</usernameVariable>
                              <passwordVariable>ELTS_TOKEN</passwordVariable>
                          </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                      </bindings>
                  </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
              </buildWrappers>
          

          Presumably only one of those sections was used because of the split. I did suspect that and then modified it to a third version

                   wrappers {
                       sshAgent(gitCredentialId)
                       colorizeOutput()
                        credentialsBinding {
                            usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")
                            if(job.containsKey("elts_credentials")) {
                                usernamePassword("ELTS_USER", "ELTS_TOKEN", job["elts_credentials"])
                            }
                        }
                        environmentVariables {
                            env("REDMINE_URL", "https://issues.redacted")
                            env("RUST_LOG", "info")
                        }             
                   }
          

          which generated

              <buildWrappers>
                  <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
                      <user>website_git</user>
                  </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
                  <hudson.plugins.ansicolor.AnsiColorBuildWrapper>
                      <colorMapName>xterm</colorMapName>
                  </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
                  <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
                      <bindings>
                          <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                              <credentialsId>redmine_api</credentialsId>
                              <usernameVariable>REDMINE_USER</usernameVariable>
                              <passwordVariable>REDMINE_API_KEY</passwordVariable>
                          </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                      </bindings>
                  </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
                  <EnvInjectBuildWrapper>
                      <info>
                          <propertiesContent>REDMINE_URL=https://issues.redacted
          RUST_LOG=info</propertiesContent>
                          <loadFilesFromMaster>false</loadFilesFromMaster>
                      </info>
                  </EnvInjectBuildWrapper>
                  <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
                      <bindings>
                          <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                              <credentialsId>typo3_elts_9_5</credentialsId>
                              <usernameVariable>ELTS_USER</usernameVariable>
                              <passwordVariable>ELTS_TOKEN</passwordVariable>
                          </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
                      </bindings>
                  </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
              </buildWrappers>
          

          Note how the section is still split in the output xml.

          Could this be caused by the previous split definition? I did not expect the past Job DSL to influence output in the current seed job.

          Either way it would probably be useful to always merge the sections and/or throw an error if multiple sections are defined.

          Matthias Hörmann added a comment - Looking at the config history of the job that originally prompted me to create this issue it looks like the Job-DSL went from (state before adding the second credential)            wrappers {              sshAgent(gitCredentialId)              colorizeOutput()               credentialsBinding {                   usernamePassword( "REDMINE_USER" , "REDMINE_API_KEY" , "redmine_api" )               }               environmentVariables {                   env( "REDMINE_URL" , "https: //issues.redacted" )                   env( "RUST_LOG" , "info" )               }        } which generated <buildWrappers> <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <user> website_git </user> </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <hudson.plugins.ansicolor.AnsiColorBuildWrapper> <colorMapName> xterm </colorMapName> </hudson.plugins.ansicolor.AnsiColorBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId> redmine_api </credentialsId> <usernameVariable> REDMINE_USER </usernameVariable> <passwordVariable> REDMINE_API_KEY </passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <EnvInjectBuildWrapper> <info> <propertiesContent> REDMINE_URL=https://issues.redacted RUST_LOG=info </propertiesContent> <loadFilesFromMaster> false </loadFilesFromMaster> </info> </EnvInjectBuildWrapper> </buildWrappers> to (first attempt to add the second credential)          wrappers {              sshAgent(gitCredentialId)              colorizeOutput()               credentialsBinding {                   usernamePassword( "REDMINE_USER" , "REDMINE_API_KEY" , "redmine_api" )               }               environmentVariables {                   env( "REDMINE_URL" , "https: //issues.redacted" )                   env( "RUST_LOG" , "info" )               }         if (job.containsKey( "elts_credentials" )) { credentialsBinding { usernamePassword( "ELTS_USER" , "ELTS_TOKEN" , job[ "elts_credentials" ]) } } which generated <buildWrappers> <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <user> website_git </user> </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <hudson.plugins.ansicolor.AnsiColorBuildWrapper> <colorMapName> xterm </colorMapName> </hudson.plugins.ansicolor.AnsiColorBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId> redmine_api </credentialsId> <usernameVariable> REDMINE_USER </usernameVariable> <passwordVariable> REDMINE_API_KEY </passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <EnvInjectBuildWrapper> <info> <propertiesContent> REDMINE_URL=https://issues.redacted RUST_LOG=info </propertiesContent> <loadFilesFromMaster> false </loadFilesFromMaster> </info> </EnvInjectBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId> typo3_elts_9_5 </credentialsId> <usernameVariable> ELTS_USER </usernameVariable> <passwordVariable> ELTS_TOKEN </passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> </buildWrappers> Presumably only one of those sections was used because of the split. I did suspect that and then modified it to a third version          wrappers {              sshAgent(gitCredentialId)              colorizeOutput()               credentialsBinding {                   usernamePassword( "REDMINE_USER" , "REDMINE_API_KEY" , "redmine_api" ) if (job.containsKey( "elts_credentials" )) { usernamePassword( "ELTS_USER" , "ELTS_TOKEN" , job[ "elts_credentials" ]) }               }               environmentVariables {                   env( "REDMINE_URL" , "https: //issues.redacted" )                   env( "RUST_LOG" , "info" )               }         } which generated <buildWrappers> <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <user> website_git </user> </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <hudson.plugins.ansicolor.AnsiColorBuildWrapper> <colorMapName> xterm </colorMapName> </hudson.plugins.ansicolor.AnsiColorBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId> redmine_api </credentialsId> <usernameVariable> REDMINE_USER </usernameVariable> <passwordVariable> REDMINE_API_KEY </passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <EnvInjectBuildWrapper> <info> <propertiesContent> REDMINE_URL=https://issues.redacted RUST_LOG=info </propertiesContent> <loadFilesFromMaster> false </loadFilesFromMaster> </info> </EnvInjectBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId> typo3_elts_9_5 </credentialsId> <usernameVariable> ELTS_USER </usernameVariable> <passwordVariable> ELTS_TOKEN </passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> </buildWrappers> Note how the section is still split in the output xml. Could this be caused by the previous split definition? I did not expect the past Job DSL to influence output in the current seed job. Either way it would probably be useful to always merge the sections and/or throw an error if multiple sections are defined.

          Vanio Begic added a comment -

          Okay, now it is clearer to me what your problem is. I will try to reproduce this locally and check how it behaves.

           

          For some reason I have thought that Job DSL plugin throws an error if section, which should not be repeated is repeated, but that does not seem to be the case here. Namely I would have expected the plugin to raise an error for following execution, since it would have seen the credentialsBinding section twice:

           
                   wrappers {
                       sshAgent(gitCredentialId)
                       colorizeOutput()
                        credentialsBinding

          {                   usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")               }

                        environmentVariables

          {                   env("REDMINE_URL", "https://issues.redacted")                  env("RUST_LOG", "info")               }

                  if(job.containsKey("elts_credentials")) {
          credentialsBinding

          { usernamePassword("ELTS_USER", "ELTS_TOKEN", job["elts_credentials"]) }

          }
           

           

          but now I am not sure if such mechanism is even available.

           

          Vanio Begic added a comment - Okay, now it is clearer to me what your problem is. I will try to reproduce this locally and check how it behaves.   For some reason I have thought that Job DSL plugin throws an error if section, which should not be repeated is repeated, but that does not seem to be the case here. Namely I would have expected the plugin to raise an error for following execution, since it would have seen the credentialsBinding section twice:            wrappers {              sshAgent(gitCredentialId)              colorizeOutput()               credentialsBinding {                   usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")               }               environmentVariables {                   env("REDMINE_URL", "https://issues.redacted")                  env("RUST_LOG", "info")               }         if(job.containsKey("elts_credentials")) { credentialsBinding { usernamePassword("ELTS_USER", "ELTS_TOKEN", job["elts_credentials"]) } }     but now I am not sure if such mechanism is even available.  

            jamietanna Jamie Tanna
            mhoermann Matthias Hörmann
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: