Source:
public void testGetTokenForRun() throws Exception { j.jenkins.setSecurityRealm(j.createDummySecurityRealm()); MockAuthorizationStrategy auth = new MockAuthorizationStrategy() .grant(Jenkins.READ).everywhere().to("alice", "bob") .grant(Computer.BUILD).everywhere().to("alice", "bob") .grant(Item.CONFIGURE).everywhere().to("alice"); j.jenkins.setAuthorizationStrategy(auth); String globalCredentialsId = "global-creds"; IdCredentials credentials = new UsernamePasswordCredentialsImpl(CredentialsScope.GLOBAL, globalCredentialsId, "test-global-creds", "user", "password"); CredentialsProvider.lookupStores(j.jenkins).iterator().next().addCredentials(Domain.global(), credentials); FreeStyleProject p1 = j.createFreeStyleProject(); FreeStyleProject p2 = j.createFreeStyleProject(); Map<String, Authentication> jobsToAuths = new HashMap<>(); jobsToAuths.put(p1.getName(), User.getById("alice", true).impersonate()); jobsToAuths.put(p2.getName(), User.getById("bob", true).impersonate()); QueueItemAuthenticatorConfiguration.get().getAuthenticators().replace(new MockQueueItemAuthenticator(jobsToAuths)); try (ACLContext as = ACL.as(User.getById("alice", false))) { DockerRegistryToken token = new DockerRegistryEndpoint("<LINK_0>", globalCredentialsId) .getToken(j.buildAndAssertSuccess(p1)); Assert.assertNotNull("Alice has Credentials.USE_ITEM and should be able to use the credential", token); Assert.assertEquals("user", token.getEmail()); Assert.assertEquals(Base64.getEncoder().encodeToString("user:password".getBytes(Charsets.UTF_8)), token.getToken()); } try (ACLContext as = ACL.as(User.getById("bob", false))) { DockerRegistryToken token = new DockerRegistryEndpoint("<LINK_0>", globalCredentialsId) .getToken(j.buildAndAssertSuccess(p2)); Assert.assertNull("Bob does not have Credentials.USE_ITEM and should not be able to use the credential", token); } }

Target:
public void testGetTokenForRun() throws Exception { j.jenkins.setSecurityRealm(j.createDummySecurityRealm()); MockAuthorizationStrategy auth = new MockAuthorizationStrategy() .grant(Jenkins.READ).everywhere().to("alice", "bob") .grant(Computer.BUILD).everywhere().to("alice", "bob") .grant(Item.CONFIGURE).everywhere().to("alice"); j.jenkins.setAuthorizationStrategy(auth); String globalCredentialsId = "global-creds"; IdCredentials credentials = new UsernamePasswordCredentialsImpl(CredentialsScope.GLOBAL, globalCredentialsId, "test-global-creds", "user", "password"); CredentialsProvider.lookupStores(j.jenkins).iterator().next().addCredentials(Domain.global(), credentials); FreeStyleProject p1 = j.createFreeStyleProject(); FreeStyleProject p2 = j.createFreeStyleProject(); Map<String, Authentication> jobsToAuths = new HashMap<>(); jobsToAuths.put(p1.getFullName(), User.getById("alice", true).impersonate()); jobsToAuths.put(p2.getFullName(), User.getById("bob", true).impersonate()); QueueItemAuthenticatorConfiguration.get().getAuthenticators().replace(new MockQueueItemAuthenticator(jobsToAuths)); FreeStyleBuild r1 = j.buildAndAssertSuccess(p1); try (ACLContext as = ACL.as(User.getById("alice", false))) { DockerRegistryToken token = new DockerRegistryEndpoint("<LINK_0>", globalCredentialsId).getToken(r1); Assert.assertNotNull("Alice has Credentials.USE_ITEM and should be able to use the credential", token); Assert.assertEquals("user", token.getEmail()); Assert.assertEquals(Base64.getEncoder().encodeToString("user:password".getBytes(Charsets.UTF_8)), token.getToken()); } FreeStyleBuild r2 = j.buildAndAssertSuccess(p2); try (ACLContext as = ACL.as(User.getById("bob", false))) { DockerRegistryToken token = new DockerRegistryEndpoint("<LINK_0>", globalCredentialsId).getToken(r2); Assert.assertNull("Bob does not have Credentials.USE_ITEM and should not be able to use the credential", token); } }