Before You Start

You need three pieces of information:

  1. Jenkins Base URL — the address of your Jenkins server (e.g. https://jenkins.example.com)
  2. Username — a Jenkins account that has administrator access
  3. API Token — a token generated for that account (see below)

Creating a Jenkins API Token

An API token is safer than using your password and can be revoked independently.

  1. Sign in to Jenkins with the account you want to use
  2. Click your username in the top-right corner, then click Security
  3. Scroll down to the API Token section
  4. Click Add new Token, give it a name (e.g. entrust-discovery), then click Generate
  5. Copy the token value immediately — it is only shown once

Required Jenkins Permissions

The script plugin executes Groovy scripts on the Jenkins Script Console (/scriptText) to extract certificate and credential data directly from the Java runtime. This requires a higher privilege level than the REST-based plugin.




Overall/Administer

Required. The Jenkins Script Console is restricted to administrators. Without this permission the server returns 403 and the plugin cannot run.



Why Overall/Administer?
The plugin posts a Groovy script to the Jenkins Script Console to programmatically open Java KeyStores (CertificateCredentialsImpl.getKeyStore()) and read file-credential content (FileCredentialsImpl.getContent()). These operations are only available through the Script Console, which Jenkins restricts to accounts with full administrator rights. The script never extracts private key material — only public certificates and metadata are read.

Verifying Script Console Access

Before configuring the plugin, confirm that the service account can reach the Script Console:

  1. Sign in to Jenkins with the service account
  2. Navigate to Manage Jenkins → Script Console (or go to <your-jenkins-url>/script)
  3. If you see the Groovy script input box, the account has the required access
  4. If you see a 403 / "access denied" page, the account needs the Overall/Administer permission

    Granting the Required Permission

The steps depend on which Security Realm / Authorization Strategy your Jenkins installation uses.

Matrix-based Security (built-in or LDAP realm)

  1. Go to Manage Jenkins → Security
  2. Under Authorization, select Matrix-based security (or Project-based Matrix Authorization Strategy)
  3. Add the service account row and tick: Overall/Administer
  4. Click Save

Role Strategy Plugin (role-strategy)

  1. Go to Manage Jenkins → Manage and Assign Roles → Manage Roles
  2. Create a Global role (e.g. discovery-admin) with: Overall/Administer
  3. Go to Assign Roles, assign the role to the service account
  4. Click Save