ExportXMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Major
    • None
    • Environment:

      Description
      After upgrading the Delinea Secret Server / Platform Jenkins plugin from 2.1.0 to 2.1.1, Jenkins is no longer able to launch SSH agents that use Delinea-backed credentials.

      The SSH connection is successfully established and host key verification succeeds. During credential resolution, the plugin throws the following exception:

      Failed to fetch credentials from vault.
      UserCredentials not found for credentialId: <credential-id>

      Immediately reverting the plugin from 2.1.1 to 2.1.0 restores functionality without any additional changes.

      Regression Verification

      • Version 2.1.0: Works correctly.
      • Version 2.1.1: Fails consistently.
      • Reverting to 2.1.0 restores normal operation immediately.
      • No changes were made to Jenkins configuration, agent configuration, Delinea configuration, permissions, or target servers.

      Steps to Reproduce
      1. Configure a Jenkins agent using SSH Launcher.
      2. Configure the launcher to use a Delinea-backed credential.
      3. Upgrade the Delinea Secret Server / Platform plugin from 2.1.0 to 2.1.1.
      4. Launch the agent.

      Expected Result
      The Delinea credential should be resolved successfully.
      SSH authentication should proceed normally and the agent should come online.

      Actual Result
      Credential resolution fails before SSH authentication begins.
      Agent launch aborts.

      Full Stack Trace

      SSHLauncher{host=<node-name>, port=22, credentialsId=<user-account>, jvmOptions='', javaPath='', prefixStartSlaveCmd='', suffixStartSlaveCmd='', launchTimeoutSeconds=60, maxNumRetries=10, retryWaitTime=15, sshHostKeyVerificationStrategy=hudson.plugins.sshslaves.verifiers.ManuallyTrustedKeyVerificationStrategy, tcpNoDelay=true, trackCredentials=true}
      [08/20/26 12:31:15] [SSH] Opening SSH connection to nwb-qaciansible:22.
      [08/20/26 12:31:15] [SSH] SSH host key matches key seen previously for this host. Connection will be allowed.
      ERROR: Failed to fetch credentials from vault. UserCredentials not found for credentialId: <dellinea-service-account>
      java.lang.RuntimeException: Failed to fetch credentials from vault. UserCredentials not found for credentialId: <dellinea-service-account>
      at PluginClassLoader for thycotic-secret-server//com.delinea.secrets.jenkins.global.cred.SecretServerCredentials.getVaultCredential(SecretServerCredentials.java:185)
      at PluginClassLoader for thycotic-secret-server//com.delinea.secrets.jenkins.global.cred.SecretServerCredentials.getUsername(SecretServerCredentials.java:134)
      at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.getUsername(SSHAuthenticator.java:134)
      at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.impl.TrileadSSHPasswordAuthenticator.canAuthenticate(TrileadSSHPasswordAuthenticator.java:83)
      at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:196)
      at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:197)
      at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:214)
      at java.base/java.util.Spliterators$IteratorSpliterator.tryAdvance(Spliterators.java:1950)
      at java.base/java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:147)
      at java.base/java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:588)
      at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:574)
      at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:560)
      at java.base/java.util.stream.FindOps$FindOp.evaluateSequential(FindOps.java:150)
      at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:265)
      at java.base/java.util.stream.ReferencePipeline.findFirst(ReferencePipeline.java:683)
      at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.newInstance(SSHAuthenticator.java:222)
      at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.newInstance(SSHAuthenticator.java:173)
      at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:890)
      at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.lambda$launch$0(SSHLauncher.java:446)
      at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:328)
      at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1090)
      at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:614)
      at java.base/java.lang.Thread.run(Thread.java:1474)
      Caused by: java.lang.RuntimeException: UserCredentials not found for credentialId: <dellinea-service-account>
      at PluginClassLoader for thycotic-secret-server//com.delinea.secrets.jenkins.global.cred.SecretServerCredentials.getVaultCredential(SecretServerCredentials.java:172)
      ... 22 more
      [08/20/26 12:31:15] Launch failed - cleaning up connection
      [08/20/26 12:31:15] [SSH] Connection closed.

      Business Impact
      All Jenkins SSH agents using Delinea-backed credentials fail to launch after upgrading to plugin version 2.1.1.
      Rollback to version 2.1.0 is currently required as a workaround.

            Assignee:
            Thycotic Dev
            Reporter:
            Elmira Atanassova
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: