i got fooled by maven deploy VS jenkins maven deploy plugin, the username/password will be still used, but most likely for a after_build: scp