CodeshipStephen Connolly12 min readintermediate
The Credentials API in Jenkins
Summary
The post explains the motivation behind Jenkins' Credentials API, recounts early design mistakes (duplicated username/password types, over‑reliance on the type system), introduces the “Oracles of Identity” concept, and shows how credential domains let users declaratively bind credentials to the right services.
- Design APIs so a single credential can be reused across many services; otherwise the API fails its core purpose.
- Avoid using the type system to “color” credentials – it creates duplicate implementations and tight coupling.
- Model credential scoping with *domains* that describe the identity store (Oracle of Identity) a credential belongs to; this lets plugins filter appropriate credentials at runtime.
- Separate credential storage from usage: prefer short‑lived services with injected tokens over persisting secrets whenever possible.
Credential sprawl leads to operational pain (e.g., frequent LDAP password rotations) and security risk. A well‑designed, domain‑aware credentials system reduces admin overhead, improves traceability, and makes CI/CD pipelines more maintainable.
6/10
