Before You Start

You need three pieces of information:

  1. Jenkins Base URL — the address of your Jenkins server (e.g. https://jenkins.example.com)
  2. Username — a Jenkins account that has permission to read credentials
  3. API Token — a token generated for that account (see below)

Creating a Jenkins API Token

An API token is safer than using your password and can be revoked independently.

  1. Sign in to Jenkins with the account you want to use
  2. Click your username in the top-right corner, then click Security
  3. Scroll down to the API Token section
  4. Click Add new Token, give it a name (e.g. entrust-discovery), then click Generate
  5. Copy the token value immediately — it is only shown once

Required Jenkins Permissions

The service account needs the following permissions. Overall/Administer grants everything implicitly; otherwise grant the minimum set below.

Permission

Why It is Needed

Overall/Read

Required to access any Jenkins API endpoint. Without this the server returns 403 on every request.

Credentials/View

Required to list credentials in each store (system and folder).

Job/Read

Required to traverse folders and discover folder-scoped credential stores. Without this, only system-level credentials are found.

If the account has Job/Read only on a subset of folders, the plugin will discover credentials in those folders and log a skip warning for the rest (and will not advance the last-scan timestamp).

Granting the Required Permissions

The steps depend on which Security Realm / Authorization Strategy your Jenkins installation uses.

Matrix-based Security (built-in or LDAP realm)

  1. Go to Manage Jenkins → Security
  2. Under Authorization, select Matrix-based security (or Project-based Matrix Authorization Strategy)
  3. Add the service account row and tick: Overall/Read, Credentials/View, Job/Read
  4. For project-based matrix, the global row covers all items; if you are using per-item ACLs, also grant Job/Read and Credentials/View on each folder you want to scan (or on a parent folder that inherits downward)
  5. Click Save

Role Strategy Plugin (role-strategy)

  1. Go to Manage Jenkins → Manage and Assign Roles → Manage Roles
  2. Create a Global role (e.g. discovery-global) with: Overall/Read, Credentials/View
  3. Create an Item role (e.g. discovery-items) with pattern .* and permissions: Job/Read, Credentials/View (the item-level Credentials/View is required to access folder-scoped credential stores, in addition to the global Credentials/View set above)
  4. Go to Assign Roles, assign both roles to the service account
  5. Click Save