Credential scoping (global, folder) in Jenkins - Step-by-Step Execution

Process Flow - Credential scoping (global, folder)

Start: Need Credential

↓

Check Folder Scope

↓

Use Folder

↓

Credential Found?

No→Error: Credential Missing

Yes↓

Use Credential in Job

This flow shows how Jenkins looks for credentials first in the folder scope, then globally if not found, before using them in a job.

Execution Sample

Jenkins

1. Define credential 'my-secret' in Folder A
2. Define credential 'my-secret' globally
3. Job in Folder A requests 'my-secret'
4. Jenkins uses Folder A's 'my-secret'

This example shows Jenkins preferring folder-scoped credentials over global ones when both exist.

Process Table

Step	Action	Credential Scope Checked	Credential Found?	Result
1	Job requests 'my-secret'	Folder A	Yes	Use Folder A's 'my-secret'
2	If not found in Folder A	Global	Yes	Use Global 'my-secret'
3	If not found globally	N/A	No	Error: Credential Missing

💡 Credential found in Folder A scope, so global scope not checked further.

Status Tracker

Variable	Start	After Step 1	After Step 2	Final
Credential 'my-secret'	Undefined	Defined in Folder A	Defined Globally	Used from Folder A

Key Moments - 2 Insights

Why does Jenkins use the folder credential instead of the global one?

Jenkins first checks the folder scope for credentials. If found there (see execution_table step 1), it uses that and does not check global scope.

What happens if the credential is not defined in either scope?

Jenkins cannot find the credential and throws an error (see execution_table step 3). This means the job cannot run securely.

Visual Quiz - 3 Questions

Look at the execution table, at which step does Jenkins find the credential in the folder scope?

A Step 3

B Step 2

C Step 1

D Never

💡 Hint

Check the 'Credential Found?' column for Folder A scope in step 1.

If the folder credential is missing, where does Jenkins look next?

A Global scope

B Job workspace

C Folder scope again

D It stops immediately

💡 Hint

See execution_table step 2 where global scope is checked after folder scope.

If both folder and global credentials are missing, what is the result?

A Jenkins uses a default credential

B Error: Credential Missing

C Job runs without credentials

D Jenkins creates a new credential automatically

💡 Hint

Look at execution_table step 3 for the outcome when no credential is found.

Concept Snapshot

Credential scoping in Jenkins:
- Jenkins checks folder-scoped credentials first.
- If not found, it checks global credentials.
- Folder credentials override global ones.
- Missing credentials cause job failure.
- Define credentials in the right scope for security.

Full Transcript

In Jenkins, when a job needs a credential, it first looks inside its folder scope. If the credential is found there, Jenkins uses it directly. If not, Jenkins checks the global scope for the credential. If still not found, Jenkins throws an error and the job cannot proceed. This ensures that folder credentials override global ones, allowing more specific control. Defining credentials properly in folder or global scope is important to avoid job failures.

Practice

1. What does Global credential scope mean in Jenkins?

easy

A. The credential can be used by any job in Jenkins.

B. The credential is only available to jobs in a specific folder.

C. The credential is only available to the Jenkins administrator.

D. The credential expires after one use.

Solution

1. Step 1: Understand credential scopes

   Global scope means credentials are accessible everywhere in Jenkins.

2. Step 2: Compare with folder scope

   Folder scope limits credentials to jobs inside that folder only.

3. Final Answer:

   The credential can be used by any job in Jenkins. -> Option A

4. Quick Check:

   Global scope = accessible to all jobs [OK]

Hint: Global means all jobs can use it, no folder limits [OK]

Common Mistakes:

• Confusing global with folder scope
• Thinking global is admin-only
• Assuming credentials expire automatically

2. Which of the following is the correct way to assign a credential to a folder in Jenkins?

easy

A. Add the credential under Jenkins > Credentials > System > Global credentials

B. Add the credential inside the folder's Credentials section

C. Add the credential in the job configuration only

D. Add the credential in Jenkins > Manage Plugins

Solution

1. Step 1: Locate folder credentials

   Folder scoped credentials are added inside the folder's own Credentials section.

2. Step 2: Differentiate from global credentials

   Global credentials are added under Jenkins system credentials, not folder.

3. Final Answer:

   Add the credential inside the folder's Credentials section -> Option B

4. Quick Check:

   Folder credentials go inside folder settings [OK]

Hint: Folder credentials must be added inside that folder [OK]

Common Mistakes:

• Adding folder credentials to global system store
• Trying to add credentials in job config only
• Confusing plugin management with credentials

3. Given a folder named ProjectA with a credential scoped to it, what happens if a job outside ProjectA tries to use that credential?

medium

A. The job can use the credential without restrictions.

B. The job will use a default global credential instead.

C. The job will fail to access the credential.

D. The job will prompt the user to enter the credential manually.

Solution

1. Step 1: Understand folder scope restrictions

   Folder scoped credentials are only accessible to jobs inside that folder.

2. Step 2: Check job location

   A job outside the folder cannot access folder-scoped credentials.

3. Final Answer:

   The job will fail to access the credential. -> Option C

4. Quick Check:

   Folder scope blocks jobs outside folder [OK]

Hint: Folder credentials block jobs outside folder [OK]

Common Mistakes:

• Assuming folder credentials are global
• Thinking Jenkins auto-fills missing credentials
• Believing jobs can prompt for credentials

4. You added a credential to a folder but jobs inside the folder still cannot access it. What is the most likely cause?

medium

A. The folder permissions prevent jobs from using credentials.

B. The jobs are not inside the folder where the credential was added.

C. The credential was added with global scope instead of folder scope.

D. The credential type is unsupported by Jenkins.

Solution

1. Step 1: Verify credential scope

   If credential is in folder, scope is correct; global scope would make it accessible everywhere.

2. Step 2: Check folder permissions

   Folder permissions can restrict job access to credentials even if scope is correct.

3. Final Answer:

   The folder permissions prevent jobs from using credentials. -> Option A

4. Quick Check:

   Permissions can block credential use inside folder [OK]

Hint: Check folder permissions if folder credentials fail [OK]

Common Mistakes:

• Assuming scope is wrong without checking permissions
• Ignoring folder membership of jobs
• Thinking Jenkins blocks unsupported credential types silently

5. You want to restrict a credential so only jobs in the DevOps folder and its subfolders can use it, but not jobs elsewhere. How should you configure the credential?

hard

A. Add the credential in each job configuration inside DevOps.

B. Add the credential with global scope and restrict job permissions manually.

C. Add the credential with system scope to limit access.

D. Add the credential with folder scope inside the DevOps folder.

Solution

1. Step 1: Understand folder scope for restriction

   Folder scope limits credential use to jobs inside that folder and its subfolders.

2. Step 2: Avoid global or system scope

   Global scope allows all jobs; system scope is not a valid Jenkins credential scope.

3. Step 3: Avoid per-job credentials for manageability

   Adding credentials per job is inefficient and error-prone.

4. Final Answer:

   Add the credential with folder scope inside the DevOps folder. -> Option D

5. Quick Check:

   Folder scope limits credential to folder and subfolders [OK]

Hint: Use folder scope inside DevOps folder for restriction [OK]

Common Mistakes:

• Using global scope and relying on permissions only
• Confusing system scope with folder scope
• Adding credentials individually to jobs