Note that the Jenkins Git plugin 2.0 will have “advance submodule behaviors”, which should ensure proper updates of the submodules:
Advanced sub-modules behavior
> “Path of the reference repo to use during submodule update
” against this field , add submodule git url.
Owen B mentions in the comments:
For the authentication issue, there’s now a “Use credentials from default remote of parent repository” option
Seen here in JENKINS-20941: