# Credentials and user impersonation

Credentials and user impersonation
==================================

By default, run-time objects such as job steps and pipeline tasks run under the account used by the CloudBees CD/RO agent at install time. This approach works well in environments where it makes sense to run all jobs under a single user such as a `build` user. In this scenario, you install all agents to run as the designated user and every step of every job runs as that user.

[](#_credentials)Credentials
----------------------------

Credentials are used to access services and resources used during application deployments, release pipeline execution, or any other automated process orchestrated by CloudBees CD/RO.

When a run-time object is configured to run as a specific user other than that defined at install time, CloudBees CD/RO retrieves the user name and password from a stored credential. The credential is passed to the CloudBees CD/RO agent over an encrypted channel so the agent can authenticate itself to the operating system and set up a security context where the object runs with the user permissions in the credential.

*   For details about creating credentials, refer to [Credential management](/docs/cloudbees-cd/latest/credentials/credential-management).
    
*   Refer to [Using credentials](/docs/cloudbees-cd/latest/pipelines/credentials) to enable them in your run-time objects.
    

[](#_credential_types)Credential Types
--------------------------------------

Credentials are used for authentication and are classified as:

*   Impersonation
    
*   Attach Parameter
    
*   Attach
    

[](#_impersonation)Impersonation
--------------------------------

At runtime, an object may need to temporarily impersonate a different user. For example, as part of your pipeline you may need to run a task that generates a certificate using privileged corporate information; that task must run under a special high-privileged account, but you want the remainder of the steps in the build to use a less-privileged account.

CloudBees CD/RO allows you to select a credential on a per-task, per-job, or per-job-step basis that the CloudBees CD/RO agent uses to impersonate a particular user for the duration of run-time object.

To impersonate a credential in a procedure step:

1.  From the CloudBees CD/RO main menu, navigate to **DevOps Essentials**  **Procedures** and select a procedure.
    
2.  On the procedure page, select **Add procedure step** to open the **New procedure step** dialog.
    
3.  On the **Credentials** tab, select **Add Credentials**.
    
4.  On the **Add credential** dialog, select the following details:
    
    1.  **Credential type**: Select credential type as Impersonation.
        
    2.  **Project**: Select the project that contains the credential. Use the search option to find your project by name.
        
    3.  **Credential**: Select a credential. Use the search option to find the credential by name.
        
    
5.  Select **Save credential**.
    

For more information, refer to [Impersonation](/docs/cloudbees-cd/latest/credentials/impersonation).

[](#_attach_parameter)Attach Parameter
--------------------------------------

In CloudBees CD/RO when configuring a procedure step, the Attach Parameter credential type allows the parameter to be passed at runtime.

To attach a credential parameter in a procedure step:

1.  From the CloudBees CD/RO main menu, navigate to **DevOps Essentials**  **Procedures** and select a procedure.
    
2.  On the procedure page, select **Add procedure step** to open the **New procedure step** dialog.
    
3.  On the **Credentials** tab, select **Add Credentials**.
    
4.  On the **Add credential** dialog, select the following details:
    
    1.  **Credential type**: Select credential type as attach parameter.
        
    2.  **Credential Parameter**: Select the parameter that you want to pass during runtime. Use the search option to find the parameter.
        
    
5.  Select **Save credential**.
    

[](#_attach)Attach
------------------

In CloudBees CD/RO when configuring a procedure, step select the Attach credential type to link a pre-defined credential to the configuration.

To attach a credential in a procedure step:

1.  From the CloudBees CD/RO main menu, navigate to **DevOps Essentials**  **Procedures** and select a procedure.
    
2.  On the procedure page, select **Add procedure step** to open the **New procedure step** dialog.
    
3.  On the **Credentials** tab, select **Add Credentials**.
    
4.  On the **Add credential** dialog, select the following details:
    
    1.  **Credential type**: Select credential type as attach.
        
    2.  **Project**: Select the project that contains the credential. Use the search option to find your project by name.
        
    3.  **Credential**: Select a credential. Use the search option to find the credential by name.
        
    
5.  Select **Save credential**.