Accessing a Username with Password Credential Parameter from a Jenkins Execute Groovy build step using Groovy command?

Question

Software levels:

Jenkins 2.121.2
Credentials Plugin 2.1.18
Credentials Binding Plugin 1.16
Plain Credentials Plugin 1.4

I am working with a Freestyle project (not a pipeline) and want to use a Groovy command build step for the job's main processing.

I am trying to obtain the userid and password from a user credential so the groovy script can use them for various CLI manipulations. I spent a lot of time searching for answers, but none of the ones I've found worked. Most were not clear, many were geared toward pipelines.

I would greatly appreciate a little guidance at this point.

Here are the gory details.

I created a new parameterized Freestyle project in which I added a Credentials Parameter for a "Username and password" credential. It defaults to one of the credentials that I defined to Jenkins via the Credentials Plugin. I'm not sure this is necessary if the binding selects the credential to use explicitly.

I checked "Use secret text(s) or file(s)" in the Build Environment section, although I'm not certain that is essential for a Username/password style binding.

I added a "Username and password (separated)" binding and set USERID and PASSWORD as the respective variables.

My groovy command window has this sole line: println("${USERID} ${PASSWORD}")

When I build the job, I get this error:

yong · Accepted Answer · 2018-08-16T02:19:29.350

2

The both ways will inject the credential into Environment Variable, thus you can access them from Environment Variable in Groovy Script as following for both ways.

def env = System.getenv()
println env['auth']
println env['USERNAME']
println env['PASSSWORD']

But the injected value of the both ways are different.

1) Adding a Credential job parameter for user to choose when run job

In this way, the credentialId is injected, so you not get the username and password.

credentialId example: 1dd4755a-9396-4819-9327-86f25650c7d7

2) Using Credential Bindings

In this way, the username and password are injected, I think this is what you wanted.

def env = System.getenv()
def username = env['USERNAME']
def password = env['PASSSWORD']

def cmd = "curl -u $username:$password ...."

Add a Jenkins Build Step supply by plugin Execute Groovy script

edited Aug 16 '18 at 02:19

answered Aug 15 '18 at 23:22

yong

13,357
1
16
27

Thank you @yong. I had been trying many different variations of that theme, when I found a rather obscure bit of information. I was using a "Groovy Script" build step and not a "System Groovy Script" build step. None of these techniques worked for me when I used the Groovy Script build step. That's because, it seems, that Jenkins runs the Groovy Script build step like any command; a separate JVM and therefore not inheriting the Jenkins environment. The System Groovy script build step runs in the Jenkins JVM, thus giving me access to the build parameters. – John Czukkermann Aug 16 '18 at 00:35
Refer to https://stackoverflow.com/questions/19634733/difference-between-execute-groovy-script-and-the-execute-system-grovy-script-in. Do note though, that the Credentials plugins will now display the userid and password parameter content using println or when echoing commands. If you redirect the output to a file, you CAN see them there. That is how I confirmed that I was finally able to access them. – John Czukkermann Aug 16 '18 at 00:42

score 0 · Answer 2 · answered Aug 16 '18 at 00:45

To summarize, the techniques identified by @yong's post will only work with System Groovy Script build steps. The latest plugin and Jenkins levels will obfuscate the credential parameters, so println cannot be used to verify their content by visual inspection.

Accessing a Username with Password Credential Parameter from a Jenkins Execute Groovy build step using Groovy command?

2 Answers2