<p>I was a little confused by the OP question and follow up, so answering about GitHub access to jenkinsfile-based pipeline jobs:
Credentials stored in Jenkins can be available to all users with rights to create jobs. Use a GitHub deployment key for your repo. Yes you need a key for every repo. This does require a user in Github, of course, but there is nothing to stop you from paying for an extra so-called 'machine user.' We, however, just use a real person like me.</p>

<p>This GitHub deploy key allows you to trigger on repo changes, or keep your jenkinsfile in Github. Using jenkinsfiles and keeping them in GitHub, is the best way to do Jenkins, I think.</p>

CC BY-SA 4.0
2019-02-25T22:42:42.800Z
2019-02-25T22:42:42.800Z
John Fisher
<p>I'd like to allow all of our organization's users to create new pipelines in Jenkins, via Blue Ocean...</p>

<p><a href="https://i.sstatic.net/SZxTT.png" rel="noreferrer"><img src="https://i.sstatic.net/SZxTT.png" alt="enter image description here"></a></p>

<p>This requires a Github access token, meaning I have to either require each user to use their own access token, or share the contents of an access token with all users.</p>

<p>The first option seems inconvenient. The second option is a security risk,  and we'd have to change our token any time someone left the organization.</p>

<p>I was hoping to find a way to add a credential to Jenkins and scope it so that all users have access to it, so the above New Pipeline flow would use that cred rather than querying the user to input a token.</p>

<p>I created a token with Global (rather than System) scope, but new users are still asked to input a token when they go to add a pipeline.</p>

<p>Is there a good solution for this? Do most organizations rely on individual developers to use their personal access tokens?</p>

CC BY-SA 4.0
2018-06-13T16:02:11.337Z
I know it's not a direct answer to your question, but would the [GitHub Branch Source Plugin](https://wiki.jenkins.io/display/JENKINS/GitHub+Branch+Source+Plugin) work for you?  This plugin automatically creates jobs for every repository in a GitHub organization that contains a Jenkinsfile, removing the need to create a new job every time you create a new repository in GitHub.
jayhendren
CC BY-SA 4.0
2018-06-14T12:21:32.880Z
Interesting. We're actually using that plugin, though not to auto-create jobs. I think that would suite our needs, but I don't see an option to enable automatic job creation. We've got version 2.3.2
ivan
CC BY-SA 4.0
2018-06-14T12:42:39.537Z
@jayhendren I should clarify, the plugin is automatically creating jobs for branches and PRs in the repositories that already have pipelines, but it's not automatically creating new pipelines.
ivan
CC BY-SA 4.0
2018-06-14T16:23:45.820Z
Not sure I follow. If you add a Jenkinsfile to an existing branch, the plug-in will create a new job automatically.
jayhendren
CC BY-SA 4.0
2018-06-14T21:44:35.813Z
@jayhendren Sorry, let me try to describe it more clearly. Our org has a GitHub account `TheOrg`. I created a pipeline for repo `TheOrg/foo`. Jenkins will create jobs for `foo`'s branches and PRs. Another member of the organization creates a repo `TheOrg/bar`. Jenkins doesn't know about it, so no builds will occur despite branch and/or PR activity in `bar`.
ivan
CC BY-SA 4.0
2018-06-14T22:53:20.983Z
The GitHub Branch Source plugin periodically scans the organization for new repositories, branches, and PRs, so it should find `bar` assuming it has at least one branch/PR containing a Jenkinsfile.  By default, the plugin scans the org once a day.  Verify that automatic scanning is turned on, the scan frequency is at a desirable setting, and that the `bar` repo has a Jenkinsfile in it.  You can run a manual scan to debug if the repo still isn't appearing.  [Docs available here.](https://go.cloudbees.com/docs/cloudbees-documentation/cje-user-guide/index.html#github-branch-source)
jayhendren
<jenkins><secret-management>
Jenkins: make a credential available to all users
ivan
# Jenkins: make a credential available to all users

(Asked by: username_0 on 2018-06-12)

I'd like to allow all of our organization's users to create new pipelines in Jenkins, via Blue Ocean...

[![enter image description here](https://i.sstatic.net/SZxTT.png)](https://i.sstatic.net/SZxTT.png)

This requires a Github access token, meaning I have to either require each user to use their own access token, or share the contents of an access token with all users.

The first option seems inconvenient. The second option is a security risk, and we'd have to change our token any time someone left the organization.

I was hoping to find a way to add a credential to Jenkins and scope it so that all users have access to it, so the above New Pipeline flow would use that cred rather than querying the user to input a token.

I created a token with Global (rather than System) scope, but new users are still asked to input a token when they go to add a pipeline.

Is there a good solution for this? Do most organizations rely on individual developers to use their personal access tokens?

**Tags:** jenkins, secret-management

> **Comments:**
> **username_1**: I know it's not a direct answer to your question, but would the [GitHub Branch Source Plugin](https://wiki.jenkins.io/display/JENKINS/GitHub+Branch+Source+Plugin) work for you?  This plugin automatically creates jobs for every repository in a GitHub organization that contains a Jenkinsfile, removing the need to create a new job every time you create a new repository in GitHub.  
> **username_0**: Interesting. We're actually using that plugin, though not to auto-create jobs. I think that would suite our needs, but I don't see an option to enable automatic job creation. We've got version 2.3.2  
> **username_0**: @username_1 I should clarify, the plugin is automatically creating jobs for branches and PRs in the repositories that already have pipelines, but it's not automatically creating new pipelines.  
> **username_1**: Not sure I follow. If you add a Jenkinsfile to an existing branch, the plug-in will create a new job automatically.  
> **username_0**: @username_1 Sorry, let me try to describe it more clearly. Our org has a GitHub account `TheOrg`. I created a pipeline for repo `TheOrg/foo`. Jenkins will create jobs for `foo`'s branches and PRs. Another member of the organization creates a repo `TheOrg/bar`. Jenkins doesn't know about it, so no builds will occur despite branch and/or PR activity in `bar`.  
> **username_1**: The GitHub Branch Source plugin periodically scans the organization for new repositories, branches, and PRs, so it should find `bar` assuming it has at least one branch/PR containing a Jenkinsfile.  By default, the plugin scans the org once a day.  Verify that automatic scanning is turned on, the scan frequency is at a desirable setting, and that the `bar` repo has a Jenkinsfile in it.  You can run a manual scan to debug if the repo still isn't appearing.  [Docs available here.](https://go.cloudbees.com/docs/cloudbees-documentation/cje-user-guide/index.html#github-branch-source)  

---

## 1 answers

### Answer by username_2 on 2019-02-25. Score: 1

I was a little confused by the OP question and follow up, so answering about GitHub access to jenkinsfile-based pipeline jobs:
Credentials stored in Jenkins can be available to all users with rights to create jobs. Use a GitHub deployment key for your repo. Yes you need a key for every repo. This does require a user in Github, of course, but there is nothing to stop you from paying for an extra so-called 'machine user.' We, however, just use a real person like me.

This GitHub deploy key allows you to trigger on repo changes, or keep your jenkinsfile in Github. Using jenkinsfiles and keeping them in GitHub, is the best way to do Jenkins, I think.


---

