-
Bug
-
Resolution: Unresolved
-
Minor
-
None
-
Jenkins 2.387.1
Job DSL 1.82
Credentials Binding Plugin 523.vd859a_4b_122e6
When defining multiple usernamePassword pairs to be set from credentials only the last one is actually configured in the job.
wrappers {
credentialsBinding {
usernamePassword("USER1", "PASS1", "credential1")
usernamePassword("USER2", "PASS2", "credential2")
}
}
Since the UI when manually configuring a job offers the ability to add multiple items I would expect all of them to be configured in the job, not just the last one.
[JENKINS-70835] Last credentialsBinding usernamePassword overrides the others instead of adding to list
Matthias Hörmann
created issue -
Vanio Begic
made changes -
| Attachment | New: image-2023-05-03-06-46-19-386.png [ 60356 ] |
Vanio Begic
made changes -
| Attachment | New: image-2023-05-03-06-48-06-642.png [ 60357 ] |
Vanio Begic
made changes -
| Attachment | New: image-2023-05-03-06-48-21-686.png [ 60358 ] |
Vanio Begic
made changes -
| Attachment | New: image-2023-05-03-06-49-20-691.png [ 60359 ] |
Vanio Begic
made changes -
| Attachment | New: image-2023-05-03-06-49-49-527.png [ 60360 ] |
Vanio Begic
added a comment - I am unable to reproduce this issue:
job('example') { wrappers { credentialsBinding { usernamePassword("USER1", "PASS1", "credential1") usernamePassword("USER2", "PASS2", "credential2") } } }
This configuration resulted in an example job being created with expected credentials:
I would vote to close this issue
Vanio Begic
added a comment - I am unable to reproduce this issue:
job( 'example' ) {
wrappers {
credentialsBinding {
usernamePassword( "USER1" , "PASS1" , "credential1" )
usernamePassword( "USER2" , "PASS2" , "credential2" )
}
}
}
This configuration resulted in an example job being created with expected credentials:
I would vote to close this issue 
Matthias Hörmann
added a comment - Looking at the config history of the job that originally prompted me to create this issue it looks like the Job-DSL went from (state before adding the second credential)
wrappers {
sshAgent(gitCredentialId)
colorizeOutput()
credentialsBinding {
usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")
}
environmentVariables {
env("REDMINE_URL", "https://issues.redacted")
env("RUST_LOG", "info")
}
}
which generated
<buildWrappers> <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <user>website_git</user> </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <hudson.plugins.ansicolor.AnsiColorBuildWrapper> <colorMapName>xterm</colorMapName> </hudson.plugins.ansicolor.AnsiColorBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId>redmine_api</credentialsId> <usernameVariable>REDMINE_USER</usernameVariable> <passwordVariable>REDMINE_API_KEY</passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <EnvInjectBuildWrapper> <info> <propertiesContent>REDMINE_URL=https://issues.redacted RUST_LOG=info</propertiesContent> <loadFilesFromMaster>false</loadFilesFromMaster> </info> </EnvInjectBuildWrapper> </buildWrappers>
to (first attempt to add the second credential)
wrappers {
sshAgent(gitCredentialId)
colorizeOutput()
credentialsBinding {
usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")
}
environmentVariables {
env("REDMINE_URL", "https://issues.redacted")
env("RUST_LOG", "info")
}
if(job.containsKey("elts_credentials")) {
credentialsBinding {
usernamePassword("ELTS_USER", "ELTS_TOKEN", job["elts_credentials"])
}
}
which generated
<buildWrappers> <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <user>website_git</user> </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <hudson.plugins.ansicolor.AnsiColorBuildWrapper> <colorMapName>xterm</colorMapName> </hudson.plugins.ansicolor.AnsiColorBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId>redmine_api</credentialsId> <usernameVariable>REDMINE_USER</usernameVariable> <passwordVariable>REDMINE_API_KEY</passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <EnvInjectBuildWrapper> <info> <propertiesContent>REDMINE_URL=https://issues.redacted RUST_LOG=info</propertiesContent> <loadFilesFromMaster>false</loadFilesFromMaster> </info> </EnvInjectBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId>typo3_elts_9_5</credentialsId> <usernameVariable>ELTS_USER</usernameVariable> <passwordVariable>ELTS_TOKEN</passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> </buildWrappers>
Presumably only one of those sections was used because of the split. I did suspect that and then modified it to a third version
wrappers {
sshAgent(gitCredentialId)
colorizeOutput()
credentialsBinding {
usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")
if(job.containsKey("elts_credentials")) {
usernamePassword("ELTS_USER", "ELTS_TOKEN", job["elts_credentials"])
}
}
environmentVariables {
env("REDMINE_URL", "https://issues.redacted")
env("RUST_LOG", "info")
}
}
which generated
<buildWrappers> <com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <user>website_git</user> </com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper> <hudson.plugins.ansicolor.AnsiColorBuildWrapper> <colorMapName>xterm</colorMapName> </hudson.plugins.ansicolor.AnsiColorBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId>redmine_api</credentialsId> <usernameVariable>REDMINE_USER</usernameVariable> <passwordVariable>REDMINE_API_KEY</passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <EnvInjectBuildWrapper> <info> <propertiesContent>REDMINE_URL=https://issues.redacted RUST_LOG=info</propertiesContent> <loadFilesFromMaster>false</loadFilesFromMaster> </info> </EnvInjectBuildWrapper> <org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> <bindings> <org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> <credentialsId>typo3_elts_9_5</credentialsId> <usernameVariable>ELTS_USER</usernameVariable> <passwordVariable>ELTS_TOKEN</passwordVariable> </org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding> </bindings> </org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper> </buildWrappers>
Note how the section is still split in the output xml.
Could this be caused by the previous split definition? I did not expect the past Job DSL to influence output in the current seed job.
Either way it would probably be useful to always merge the sections and/or throw an error if multiple sections are defined.
Matthias Hörmann
added a comment - Looking at the config history of the job that originally prompted me to create this issue it looks like the Job-DSL went from (state before adding the second credential)
wrappers {
sshAgent(gitCredentialId)
colorizeOutput()
credentialsBinding {
usernamePassword( "REDMINE_USER" , "REDMINE_API_KEY" , "redmine_api" )
}
environmentVariables {
env( "REDMINE_URL" , "https: //issues.redacted" )
env( "RUST_LOG" , "info" )
}
}
which generated
<buildWrappers>
<com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
<user> website_git </user>
</com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
<hudson.plugins.ansicolor.AnsiColorBuildWrapper>
<colorMapName> xterm </colorMapName>
</hudson.plugins.ansicolor.AnsiColorBuildWrapper>
<org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
<bindings>
<org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
<credentialsId> redmine_api </credentialsId>
<usernameVariable> REDMINE_USER </usernameVariable>
<passwordVariable> REDMINE_API_KEY </passwordVariable>
</org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
</bindings>
</org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
<EnvInjectBuildWrapper>
<info>
<propertiesContent> REDMINE_URL=https://issues.redacted
RUST_LOG=info </propertiesContent>
<loadFilesFromMaster> false </loadFilesFromMaster>
</info>
</EnvInjectBuildWrapper>
</buildWrappers>
to (first attempt to add the second credential)
wrappers {
sshAgent(gitCredentialId)
colorizeOutput()
credentialsBinding {
usernamePassword( "REDMINE_USER" , "REDMINE_API_KEY" , "redmine_api" )
}
environmentVariables {
env( "REDMINE_URL" , "https: //issues.redacted" )
env( "RUST_LOG" , "info" )
}
if (job.containsKey( "elts_credentials" )) {
credentialsBinding {
usernamePassword( "ELTS_USER" , "ELTS_TOKEN" , job[ "elts_credentials" ])
}
}
which generated
<buildWrappers>
<com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
<user> website_git </user>
</com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
<hudson.plugins.ansicolor.AnsiColorBuildWrapper>
<colorMapName> xterm </colorMapName>
</hudson.plugins.ansicolor.AnsiColorBuildWrapper>
<org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
<bindings>
<org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
<credentialsId> redmine_api </credentialsId>
<usernameVariable> REDMINE_USER </usernameVariable>
<passwordVariable> REDMINE_API_KEY </passwordVariable>
</org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
</bindings>
</org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
<EnvInjectBuildWrapper>
<info>
<propertiesContent> REDMINE_URL=https://issues.redacted
RUST_LOG=info </propertiesContent>
<loadFilesFromMaster> false </loadFilesFromMaster>
</info>
</EnvInjectBuildWrapper>
<org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
<bindings>
<org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
<credentialsId> typo3_elts_9_5 </credentialsId>
<usernameVariable> ELTS_USER </usernameVariable>
<passwordVariable> ELTS_TOKEN </passwordVariable>
</org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
</bindings>
</org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
</buildWrappers>
Presumably only one of those sections was used because of the split. I did suspect that and then modified it to a third version
wrappers {
sshAgent(gitCredentialId)
colorizeOutput()
credentialsBinding {
usernamePassword( "REDMINE_USER" , "REDMINE_API_KEY" , "redmine_api" )
if (job.containsKey( "elts_credentials" )) {
usernamePassword( "ELTS_USER" , "ELTS_TOKEN" , job[ "elts_credentials" ])
}
}
environmentVariables {
env( "REDMINE_URL" , "https: //issues.redacted" )
env( "RUST_LOG" , "info" )
}
}
which generated
<buildWrappers>
<com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
<user> website_git </user>
</com.cloudbees.jenkins.plugins.sshagent.SSHAgentBuildWrapper>
<hudson.plugins.ansicolor.AnsiColorBuildWrapper>
<colorMapName> xterm </colorMapName>
</hudson.plugins.ansicolor.AnsiColorBuildWrapper>
<org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
<bindings>
<org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
<credentialsId> redmine_api </credentialsId>
<usernameVariable> REDMINE_USER </usernameVariable>
<passwordVariable> REDMINE_API_KEY </passwordVariable>
</org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
</bindings>
</org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
<EnvInjectBuildWrapper>
<info>
<propertiesContent> REDMINE_URL=https://issues.redacted
RUST_LOG=info </propertiesContent>
<loadFilesFromMaster> false </loadFilesFromMaster>
</info>
</EnvInjectBuildWrapper>
<org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
<bindings>
<org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
<credentialsId> typo3_elts_9_5 </credentialsId>
<usernameVariable> ELTS_USER </usernameVariable>
<passwordVariable> ELTS_TOKEN </passwordVariable>
</org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding>
</bindings>
</org.jenkinsci.plugins.credentialsbinding.impl.SecretBuildWrapper>
</buildWrappers>
Note how the section is still split in the output xml.
Could this be caused by the previous split definition? I did not expect the past Job DSL to influence output in the current seed job.
Either way it would probably be useful to always merge the sections and/or throw an error if multiple sections are defined. Vanio Begic
added a comment - Okay, now it is clearer to me what your problem is. I will try to reproduce this locally and check how it behaves.
For some reason I have thought that Job DSL plugin throws an error if section, which should not be repeated is repeated, but that does not seem to be the case here. Namely I would have expected the plugin to raise an error for following execution, since it would have seen the credentialsBinding section twice:
wrappers {
sshAgent(gitCredentialId)
colorizeOutput()
credentialsBinding
environmentVariables
{ env("REDMINE_URL", "https://issues.redacted") env("RUST_LOG", "info") } if(job.containsKey("elts_credentials")) {
credentialsBinding
}
but now I am not sure if such mechanism is even available.
Vanio Begic
added a comment - Okay, now it is clearer to me what your problem is. I will try to reproduce this locally and check how it behaves.
For some reason I have thought that Job DSL plugin throws an error if section, which should not be repeated is repeated, but that does not seem to be the case here. Namely I would have expected the plugin to raise an error for following execution, since it would have seen the credentialsBinding section twice:
wrappers {
sshAgent(gitCredentialId)
colorizeOutput()
credentialsBinding
{
usernamePassword("REDMINE_USER", "REDMINE_API_KEY", "redmine_api")
}
environmentVariables
{
env("REDMINE_URL", "https://issues.redacted") env("RUST_LOG", "info")
}
if(job.containsKey("elts_credentials")) {
credentialsBinding
{
usernamePassword("ELTS_USER", "ELTS_TOKEN", job["elts_credentials"])
}
}
but now I am not sure if such mechanism is even available.
Note that in this case I would expect the block to be called credentialBindings (plural) instead of credentialBinding (singular). That would mean breakage of API, thus I would recommend adding another block instead of changing the behavior of existing block if that is possible.
Also this sound like a good candidate for first issue. If that is the case I would like to lend a hand and start working on this one.