通过Groovy访问Jenkins凭据存储区

dzjeubhm  于 2022-11-01  发布在  Jenkins
关注(0)|答案(4)|浏览(220)

我找到了一种访问credentials store in Jenkins的方法:

def getPassword = { username ->
    def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
        com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials.class,
        jenkins.model.Jenkins.instance
    )

    def c = creds.findResult { it.username == username ? it : null }

    if ( c ) {
        println "found credential ${c.id} for username ${c.username}"

        def credentials_store = jenkins.model.Jenkins.instance.getExtensionList(
            'com.cloudbees.plugins.credentials.SystemCredentialsProvider'
            )[0].getStore()

         println "result: " + credentials_store
    } else {
      println "could not find credential for ${username}"
    }
}

getPassword("XYZ")

但现在我想得到的密码为适当的用户,我不能这样做...
我总是得到未知的方法等,如果我试图访问密码等。
这样做的原因是使用这个用户名/密码来调用git并从仓库中提取信息。
我总是得到这样的东西:

result: com.cloudbees.plugins.credentials.SystemCredentialsProvider$StoreImpl@1639eab2

更新

经过更多的实验(和Jeanne Boyarsky的提示),我发现我正在考虑编译。下面已经给了我用户的密码:

def getUserPassword = { username ->
    def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
            com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials.class,
            jenkins.model.Jenkins.instance
            )

    def c = creds.findResult { it.username == username ? it : null }

    if ( c ) {
        return c.password
    } else {
        println "could not find credential for ${username}"
    }
}

此外,通过使用以下代码段,您可以迭代整个凭据存储区:

def credentials_store = jenkins.model.Jenkins.instance.getExtensionList(
        'com.cloudbees.plugins.credentials.SystemCredentialsProvider'
        )

println "credentials_store: ${credentials_store}"
println " Description: ${credentials_store.description}"
println " Target: ${credentials_store.target}"
credentials_store.each {  println "credentials_store.each: ${it}" }

credentials_store[0].credentials.each { it ->
    println "credentials: -> ${it}"
    if (it instanceof com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl) {
        println "XXX: username: ${it.username} password: ${it.password} description: ${it.description}"
    }
}

您将得到如下输出:

[(master)]:
credentials_store: [com.cloudbees.plugins.credentials.SystemCredentialsProvider@5a2822be]
 Description: [The descriptions...]
 Target: [com.cloudbees.plugins.credentials.SystemCredentialsProvider@5a2822be]
credentials_store.each: com.cloudbees.plugins.credentials.SystemCredentialsProvider@5a2822be
credentials: -> com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey@38357ca1
credentials: -> com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey@47cf7703
credentials: -> com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl@739abac5
XXX: username: User1 password: Password description: The description of the user.
credentials: -> com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl@884a53e6
XXX: username: User2 password: Password1 description: The description of the user1.
Result:   [com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey@38357ca1, com.cloudbees.jenkins.plugins.sshcredentials.impl.BasicSSHUserPrivateKey@47cf7703, com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl@739abac5, com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl@884a53e6]

因此,通过使用appropriate class in the instanceof clause,您可以选择您需要的内容。

plupiseo

plupiseo1#

这是可行的。它获取凭据而不是存储。
我没有写任何错误处理,所以如果你没有设置一个凭证对象(或者你有两个凭证对象),它会崩溃。这部分很容易添加。棘手的部分是获得正确的API!

def getPassword = { username ->
    def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
        com.cloudbees.plugins.credentials.common.StandardUsernamePasswordCredentials.class,
        jenkins.model.Jenkins.instance
    )

    def c = creds.findResult { it.username == username ? it : null }

    if ( c ) {
        println "found credential ${c.id} for username ${c.username}"

        def systemCredentialsProvider = jenkins.model.Jenkins.instance.getExtensionList(
            'com.cloudbees.plugins.credentials.SystemCredentialsProvider'
            ).first()

      def password = systemCredentialsProvider.credentials.first().password

      println password

    } else {
      println "could not find credential for ${username}"
    }
}

getPassword("jeanne")
6g8kf2rb

6g8kf2rb2#

jenkins wiki的官方解决方案
打印系统中所有凭据及其ID的列表。

def creds = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
        com.cloudbees.plugins.credentials.Credentials.class,
        Jenkins.instance,
        null,
        null
);
for (c in creds) {
    println(c.id + ": " + c.description)
}
csga3l58

csga3l583#

如果您只想检索给定凭据ID的凭据,最简单的方法是使用withCredentials管道步骤将凭据绑定到变量。

withCredentials([usernamePassword( credentialsId: 'myCredentials', 
                     usernameVariable: 'MYUSER', passwordVariable: 'MYPWD' )]) { 
    echo "User: $MYUSER, Pwd: $MYPWD" 
}
0yycz8jy

0yycz8jy4#

一个获取凭据值的行程序

假设...

def CREDENTIAL_ID = "<key_credential_id"
获取私钥凭据的一个行程序:

有关提取值的方法,请参见ssh credentials implementations

def PRIVATE_KEY = com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getStore().getCredentials(com.cloudbees.plugins.credentials.domains.Domain.global()).find { it.getId().equals(CREDENTIAL_ID) }.getPrivateKey()
获取用户名/密码凭据的一个行程序:

有关提取值的方法,请参见username password credentials implementations
第一个

获取字符串凭据的一个行程序:

有关提取值的方法,请参见plain credentials implementation

def SECRET = com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getStore().getCredentials(com.cloudbees.plugins.credentials.domains.Domain.global()).find { it.getId().equals(CREDENTIAL_ID) }.getSecret().getPlainText()

这允许您执行诸如将凭据注入Docker代理之类的操作:

def CREDENTIAL_ID = "<key_credential_id"
def SECRET = com.cloudbees.plugins.credentials.SystemCredentialsProvider.getInstance().getStore().getCredentials(com.cloudbees.plugins.credentials.domains.Domain.global()).find { it.getId().equals(CREDENTIAL_ID) }.getSecret().getPlainText()
pipeline {
    agent {
        dockerfile {
            filename "build/Jenkins.Dockerfile"
            additionalBuildArgs "--build-arg SECRET=${SECRET}"
        }
    }
    ...
}

相关问题