I would like my credential provider's implementations of the standard credential types to use the same icons as the built-in disk credentials provider, since this follows user expectations. (Indeed a user of my provider has filed a bug because they differ.)

But although the credential icons seem to be provided centrally, the icon class name strings are not available centrally (as static constants). Instead they are returned inline in the disk credentials provider descriptors. For example:

public class UsernamePasswordCredentialsImpl 
    extends BaseStandardCredentials
    implements StandardUsernamePasswordCredentials {

    // ...

    @Extension(ordinal = 1)
    public static class DescriptorImpl extends BaseStandardCredentialsDescriptor {

        @Override
        public String getIconClassName() {
            // We can't access this from downstream providers
            return "icon-credentials-userpass";
        }
    }

This means the only way to use those strings in downstream credential providers is to copy and paste them. Icon rendering will break if the name strings change in future.

Solution: The icon class names should be available as public static string constants somewhere in the credentials plugin.