Allow programmatic QueueItemAuthenticators that are not user configurable

core/src/main/java/hudson/model/Queue.java

@@ -65,6 +65,7 @@ import hudson.model.queue.CauseOfBlockage.BecauseLabelIsOffline;
 import hudson.model.queue.CauseOfBlockage.BecauseNodeIsBusy;
 import hudson.model.queue.WorkUnitContext;
 import hudson.security.ACL;
+import jenkins.security.QueueItemAuthenticatorProvider;
 import jenkins.util.Timer;
 import hudson.triggers.SafeTimerTask;
 import hudson.util.TimeUnit2;
@@ -1643,7 +1644,7 @@ public class Queue extends ResourceController implements Saveable {
          */
         @Nonnull
         public Authentication authenticate() {
-            for (QueueItemAuthenticator auth : QueueItemAuthenticatorConfiguration.get().getAuthenticators()) {
+            for (QueueItemAuthenticator auth : QueueItemAuthenticatorProvider.authenticators()) {
                 Authentication a = auth.authenticate(this);
                 if (a!=null)
                     return a;

core/src/main/java/jenkins/security/QueueItemAuthenticatorConfiguration.java

 package jenkins.security;
 
+import edu.umd.cs.findbugs.annotations.NonNull;
 import hudson.Extension;
 import hudson.model.AbstractProject;
 import hudson.security.ACL;
@@ -12,6 +13,7 @@ import org.acegisecurity.Authentication;
 import org.kohsuke.stapler.StaplerRequest;
 
 import java.io.IOException;
+import java.util.List;
 
 /**
  * Show the {@link QueueItemAuthenticator} configurations on the system config page.
@@ -55,4 +57,14 @@ public class QueueItemAuthenticatorConfiguration extends GlobalConfiguration {
     public static QueueItemAuthenticatorConfiguration get() {
         return Jenkins.getInstance().getInjector().getInstance(QueueItemAuthenticatorConfiguration.class);
     }
+
+    @Extension(ordinal = 100)
+    public static class ProviderImpl extends QueueItemAuthenticatorProvider {
+
+        @NonNull
+        @Override
+        public List<QueueItemAuthenticator> getAuthenticators() {
+            return get().getAuthenticators();
+        }
+    }
 }

core/src/main/java/jenkins/security/QueueItemAuthenticatorProvider.java

+package jenkins.security;
+
+import edu.umd.cs.findbugs.annotations.NonNull;
+import hudson.Extension;
+import hudson.ExtensionPoint;
+import jenkins.model.Jenkins;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Iterator;
+import java.util.List;
+import java.util.NoSuchElementException;
+
+/**
+ * There are cases where a plugin need to provide a {@link QueueItemAuthenticator} that cannot be controlled or
+ * configured by the user. This extension point provides the mechanism whereby the a {@link QueueItemAuthenticator}
+ * can be provided either before or after those provided by {@link QueueItemAuthenticatorConfiguration} which
+ * will use {@link Extension#ordinal()} of {@code 100}
+ * @since 1.592
+ */
+public abstract class QueueItemAuthenticatorProvider implements ExtensionPoint {
+
+    @NonNull
+    public abstract List<QueueItemAuthenticator> getAuthenticators();
+
+    public static Iterable<QueueItemAuthenticator> authenticators() {
+        return new IterableImpl();
+    }
+
+    private static class IteratorImpl implements Iterator<QueueItemAuthenticator> {
+        private final Iterator<QueueItemAuthenticatorProvider> providers;
+        private Iterator<QueueItemAuthenticator> delegate = null;
+
+        private IteratorImpl() {
+            final Jenkins jenkins = Jenkins.getInstance();
+            providers = new ArrayList<QueueItemAuthenticatorProvider>(jenkins == null
+                    ? Collections.<QueueItemAuthenticatorProvider>emptyList()
+                    : jenkins.getExtensionList(QueueItemAuthenticatorProvider.class)).iterator();
+        }
+
+        @Override
+        public boolean hasNext() {
+            while ((delegate == null || !delegate.hasNext()) && (providers.hasNext())) {
+                final QueueItemAuthenticatorProvider provider = providers.next();
+                if (provider == null) {
+                    continue;
+                }
+                delegate = new ArrayList<QueueItemAuthenticator>(provider.getAuthenticators()).iterator();
+            }
+            return delegate != null && delegate.hasNext();
+        }
+
+        @Override
+        public QueueItemAuthenticator next() {
+            if (!hasNext()) {
+                throw new NoSuchElementException();
+            }
+            return delegate.next();
+        }
+    }
+
+    private static class IterableImpl implements Iterable<QueueItemAuthenticator> {
+        @Override
+        public Iterator<QueueItemAuthenticator> iterator() {
+            return new IteratorImpl();
+        }
+    }
+}