Support scoping of credentials to lists of ItemGroups

[schiasileon]

This supersedes #40.
Linked issues:
https://issues.jenkins.io/browse/JENKINS-63416
https://issues.jenkins.io/browse/JENKINS-53105

This PR introduces folder-scoping of credentials by adding the jenkins.io/credentials-item-group annotation. Credentials will then only be available to the specified ItemGroup/Folder/Job + children.

Improvements to #40 :

• Introduced a new type for storing parsed credential data apart from IdCredential
• Syntax of annotation is now ["/job/thisIsJobA/", "/job/thisIsJobB/job/nestedJob/"] allowing for all paths to be parsed to list
• All paths must begin and end with '/'
• Previous label is now an annotation

[schiasileon]

open for discussion on a better annotation name

[jtnord]

naming is hard :)

jenkins.io/credentials-store-location (s) ?

[schiasileon]

FYI: @jtnord @danielwegener

[jtnord]

what about the UI/UX? Would this not show credentials as avaialble at the root which are not actually available (as they are only available in a specific folder)?

Additionally the docs should describe how to use the feature.

[jtnord]

the Access check should be scoped to the context. if you have CredentialsProvider.View on a folder (but not Jenkins itself) you should be able to view credentials assigned to that folder

Additionally I beleive we still only support a global domain?

Suggested change

	if(Jenkins.getInstance().hasPermission(CredentialsProvider.VIEW)) {
	// Only the global domain is supported
	if (Domain.global().equals(domain)) {
	// walk the parent until we get the AccessControlled object
	AccessControlled ac = null;
	ItemGroup ig = context;
	while (ac == null) {
	if (ig instanceOf AccessControlled) {
	ac = (AccessControlled)ig;
	} else {
	ig = ((Item) ig).getParent();
	}
	}
	if (ac.hasPermission(CredentialsProvider.VIEW) {
	return provider.getCredentials(Credentials.class, context, ACL.SYSTEM);
	}
	return Collections.emptyList();
	}

[schiasileon]

@jtnord any more feedback?

[jtnord]

@jtnord any more feedback?

I think it looks ok, but I want to find some time to fully check for any security related implications, I may not be able to get around to that until next week.

[schiasileon]

@jtnord any more feedback?

I think it looks ok, but I want to find some time to fully check for any security related implications, I may not be able to get around to that until next week.

bumping @jtnord

[jtnord]

kubernetes-credentials-provider-plugin/src/main/java/com/cloudbees/jenkins/plugins/kubernetes_credentials_provider/KubernetesCredentialsStore.java

Lines 43 to 47 in 3a776a5

	@Override
	public boolean hasPermission(@NonNull Authentication authentication, @NonNull Permission permission) {
	return CredentialsProvider.VIEW.equals(permission) &&
	Jenkins.getInstance().getACL().hasPermission(authentication, permission);
	}

looks incorrect now and should be checking the permission on the context similar to

kubernetes-credentials-provider-plugin/src/main/java/com/cloudbees/jenkins/plugins/kubernetes_credentials_provider/KubernetesCredentialsStore.java

Lines 57 to 70 in 3a776a5

	AccessControlled ac = null;
	ItemGroup<?> ig = context;
	while (ac == null) {
	if (ig instanceof AccessControlled) {
	ac = (AccessControlled)ig;
	} else if(ig instanceof Item){
	ig = ((Item) ig).getParent();
	} else {
	break;
	}
	}
	if (ac == null || ac.hasPermission(CredentialsProvider.VIEW)) {
	return provider.getCredentials(Credentials.class, context, ACL.SYSTEM);
	}

but I think both should fallback to checking the permission on Jenkins should the AccessControlled be null

[jtnord]

many thanks @schiasileon

[jtnord]

@jtnord @schiasileon Sorry to disturb you guys. This is out of topic but I am not able to find the answer on google, though to talk here

please use https://www.jenkins.io/participate/connect/#join-our-chats-and-forums

[RaveNoX]

It looks like this PR is produces credential leakage of SYSTEM scoped credential to the top-level jobs.
Tested on Freestyle job with Credentials Binding Plugin.

Previous version 1.258.v95949f923a_a_e of the plugin is not affected.