Jenkins SSO
Configure single sign-on (SSO) for Jenkins using Identity as a Service (IDaaS) and the SAML 2.0 protocol. Once configured, users can log in to Jenkins through the IDaaS portal or directly from the Jenkins login page — no separate Jenkins credentials required.
Prerequisites
Before you begin, make sure you have:
An IDaaS instance with administrator access
A running Jenkins instance with administrator access
The root domain of your Jenkins installation (for example,
https://jenkins.example.com)
Step 1: Add a Jenkins application in IDaaS
Log in to the Alibaba Cloud IDaaS console.IDaaS Management Console
Select your IDaaS instance and click Manage in the Actions
column.Go to Application > Add Application > Marketplace, search for Jenkins, and click Add Application. After the application is added, you are redirected to the SSO tab.
Configure the following SSO settings:
Field Description Jenkins Service Address The root domain of your Jenkins instance. Do not include a trailing slash ( /). For example,https://jenkins.example.com.Application Username The IDaaS account name is used as the Jenkins login identity by default. Jenkins supports just-in-time (JIT) provisioning: if the mapped account does not exist in Jenkins, Jenkins creates it automatically during the first SSO login. To customize the account mapping, see SAML Application Account Configuration. Authorize For testing, set this to accessible to all users. To restrict access to specific IDaaS accounts, see General Instructions for Single Sign-On. Click Save. The SSO configuration in IDaaS is now complete.
Scroll to the Application Settings section at the bottom of the SSO page. Copy the URL next to IdP Metadata — you need it in the next step.
Step 2: Configure SSO in Jenkins
After you save the SAML configuration, Jenkins administrator-based login is disabled. Only IDaaS accounts can log in. If you are locked out, disable the Jenkins security configuration using the Jenkins command-line interface, fix the issue, then re-enable it.
Log in to the Jenkins management console as an administrator and go to System Management > Plugin Management.
Click Available Plugins, search for SAML, and install the plugin. Wait for the installation to complete. If the installer prompts you to update dependent plugins or restart Jenkins, follow the on-screen instructions.
After installation, go to System Management > Global security configuration. Confirm that SAML 2.0 appears in the Security Domain drop-down list. If it does, the plugin is installed correctly.
Select SAML 2.0. The only required field is IdP Metadata URL — leave other fields at their defaults unless you have specific requirements.
Paste the IdP metadata URL you copied from IDaaS into the IdP Metadata URL field.
Click Validate IdP Metadata URL to verify the URL is reachable and returns valid metadata.
Click Save.
Step 3: Verify Jenkins SSO
Jenkins supports two SSO flows:
IdP-initiated SSO: The user logs in from the IDaaS portal and launches Jenkins from there.
SP-initiated SSO: The user navigates directly to Jenkins, is redirected to IDaaS for authentication, and is then returned to Jenkins.
Verify IdP-initiated SSO
Log in to the IDaaS portal using an IDaaS account that is authorized to access Jenkins. Click the Jenkins icon. You should be logged in to Jenkins automatically.
Verify SP-initiated SSO
Open an anonymous browser session and navigate to your Jenkins URL. You should be redirected to the IDaaS login page. After you authenticate, you are logged in to Jenkins.
JIT provisioning is active. If the IDaaS account does not exist in Jenkins, Jenkins creates it automatically on the first login.
What's next
To manage which IDaaS accounts can access Jenkins, see General Instructions for Single Sign-On.
To customize how IDaaS account attributes map to Jenkins user properties, see SAML Application Account Configuration.