Credential scoping (global, folder) in Jenkins - Step-by-Step Execution

Process Flow - Credential scoping (global, folder)

Start: Need Credential

↓

Check Folder Scope

↓

Use Folder

↓

Credential Found?

No→Error: Credential Missing

Yes↓

Use Credential in Job

This flow shows how Jenkins looks for credentials first in the folder scope, then globally if not found, before using them in a job.

Execution Sample

Jenkins

1. Define credential 'my-secret' in Folder A
2. Define credential 'my-secret' globally
3. Job in Folder A requests 'my-secret'
4. Jenkins uses Folder A's 'my-secret'

This example shows Jenkins preferring folder-scoped credentials over global ones when both exist.

Process Table

Step	Action	Credential Scope Checked	Credential Found?	Result
1	Job requests 'my-secret'	Folder A	Yes	Use Folder A's 'my-secret'
2	If not found in Folder A	Global	Yes	Use Global 'my-secret'
3	If not found globally	N/A	No	Error: Credential Missing

💡 Credential found in Folder A scope, so global scope not checked further.

Status Tracker

Variable	Start	After Step 1	After Step 2	Final
Credential 'my-secret'	Undefined	Defined in Folder A	Defined Globally	Used from Folder A

Key Moments - 2 Insights

Why does Jenkins use the folder credential instead of the global one?

Jenkins first checks the folder scope for credentials. If found there (see execution_table step 1), it uses that and does not check global scope.

What happens if the credential is not defined in either scope?

Jenkins cannot find the credential and throws an error (see execution_table step 3). This means the job cannot run securely.

Visual Quiz - 3 Questions

Look at the execution table, at which step does Jenkins find the credential in the folder scope?

A Step 3

B Step 2

C Step 1

D Never

💡 Hint

Check the 'Credential Found?' column for Folder A scope in step 1.

If the folder credential is missing, where does Jenkins look next?

A Global scope

B Job workspace

C Folder scope again

D It stops immediately

💡 Hint

See execution_table step 2 where global scope is checked after folder scope.

If both folder and global credentials are missing, what is the result?

A Jenkins uses a default credential

B Error: Credential Missing

C Job runs without credentials

D Jenkins creates a new credential automatically

💡 Hint

Look at execution_table step 3 for the outcome when no credential is found.

Concept Snapshot

Credential scoping in Jenkins:
- Jenkins checks folder-scoped credentials first.
- If not found, it checks global credentials.
- Folder credentials override global ones.
- Missing credentials cause job failure.
- Define credentials in the right scope for security.

Full Transcript

In Jenkins, when a job needs a credential, it first looks inside its folder scope. If the credential is found there, Jenkins uses it directly. If not, Jenkins checks the global scope for the credential. If still not found, Jenkins throws an error and the job cannot proceed. This ensures that folder credentials override global ones, allowing more specific control. Defining credentials properly in folder or global scope is important to avoid job failures.