ARTIFACTORY: Artifactory OIDC Integration with AWS IAM Outbound Identity Federation

Artifactory’s OIDC integration enables it to authenticate with AWS IAM using a JWT issued by an AWS IAM identity. This method eliminates the need for long-lived credentials and ensures a consistent authentication process. The JWT can be obtained either through a Python script or directly via the AWS CLI by calling the GetWebIdentityToken API of the AWS Security Token Service (STS). 
This article provides step-by-step guidance for integrating AWS IAM with Artifactory using OIDC.

Step 1: Enable AWS IAM Outbound Identity Federation

1. Navigate to AWS Console → IAM → Account settings under Access management (left-hand menu).
2. Enable Outbound Identity Federation(right hand side).
3. Ensure that the AWS region from which you will connect to Artifactory is enabled under Endpoints.
4. Copy the Token Issuer URL, as it will be required for the Artifactory configuration.

 


Step 2: Configure IAM Permissions

1. Go to AWS → IAM and select the appropriate user or role.
2. Attach a managed policy or an inline policy with the following permission:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "sts:GetWebIdentityToken",
      "Resource": "*",
    }
  ]
}

Step 3: Configure OIDC Integration in Artifactory

1. In the Artifactory UI, navigate to: Administration → General Management → Manage Integrations → New Integration → OpenID Connect
2. Set the Provider Type to Generic OpenID Connect.
3. Configure both the Provider URL and Token Issuer using the Token Issuer URL copied from AWS.
4. Specify the Provider Name and Audience as required(Please note these values, as they will be needed when generating the OIDC token).
5. Create Identity Mappings by clicking Add Identity Mapping.
   • Use the Claims JSON field to define the claims and values to be matched during authentication.
   • The supported claims can be viewed at: https://<Token Issuer URL>/.well-known/openid-configuration. Based on our testing, the supported claims include: sub, iss, aud, exp, iat, jti. You can also click on “key values” under “Claims JSON” to find the available claims. 
   • Configure the token scope and expiry to restrict permissions and token validity.

Sample OIDC settings and identity mappings are included for reference below.

OIDC Integration:

 

Identity mappings:

 
Step 4: Test the OIDC Integration

The JWT token used to authenticate with Artifactory can only be generated using the AWS SDK via the GetWebIdentityToken API. This can be executed from a machine with AWS SDK installed or using AWS CloudShell.

Sample Python script:

#!/usr/bin/env python3
import os, sys, json, time, logging, requests, boto3

# ---------------------------
# Config
# ---------------------------
JPD_URL = os.environ.get("JPD_URL", "https://artifactory.example.com")
PROVIDER_NAME = os.environ.get("PROVIDER_NAME", "aws-iam-test")
REPO_NAME = "test-ap-generic"
AWS_REGION = os.environ.get("AWS_REGION", "ap-south-1")
AUDIENCE = os.environ.get("AUDIENCE", "jfrog-test-audience")

verbose = '-v' in sys.argv
logging.basicConfig(level=logging.DEBUG if verbose else logging.INFO, format='%(asctime)s - %(levelname)s - %(message)s')
logger = logging.getLogger(__name__)

def check(val, msg):
    if not val:
        logger.error(msg)
        sys.exit(1)
    return val

def main():
    logger.info("Starting Artifactory OIDC upload script...")

    # 1. Get AWS Web Identity Token
    sts = boto3.client('sts', region_name=AWS_REGION)
    ID_TOKEN = check(
        sts.get_web_identity_token(Audience=[AUDIENCE], SigningAlgorithm='RS256', DurationSeconds=300).get("WebIdentityToken"),
        "Failed to get AWS WebIdentityToken"
    )
    logger.debug(f"AWS WebIdentityToken: {ID_TOKEN}")

    # 2. Exchange token with Artifactory
    payload = {
        "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange",
        "subject_token_type": "urn:ietf:params:oauth:token-type:id_token",
        "subject_token": ID_TOKEN,
        "provider_name": PROVIDER_NAME
    }
    r = requests.post(f"{JPD_URL}/access/api/v1/oidc/token", json=payload, headers={"Content-Type": "application/json"}, timeout=10)
    check(r.ok, f"OIDC token exchange failed: {r.status_code} {r.text}")
    access_token = check(r.json().get("access_token"), "No access_token received from Artifactory")
    logger.debug(f"Artifactory access token: {access_token}")

    # 3. Upload artifact
    ts = time.strftime("%Y%m%d%H%M%S")
    upload_url = f"{JPD_URL}/artifactory/{REPO_NAME}/oidc-upload-{ts}"
    r = requests.put(upload_url, data="Content to upload from Python script using AWS OIDC",
                     headers={"Authorization": f"Bearer {access_token}", "Content-Type": "text/plain"}, timeout=10)
    check(r.status_code in (200, 201), f"Upload failed: {r.status_code} {r.text}")

    logger.info(f"Upload successful! Artifact URL: {upload_url}")
    print(json.dumps({"message": "Upload successful", "artifact_path": upload_url}, indent=2))

if __name__ == "__main__":
    main()

Results:

$ python3 oidc_rt.py
2026-01-13 13:54:15,350 - INFO - Starting Artifactory OIDC upload script...
2026-01-13 13:54:15,794 - INFO - Upload successful! Artifact URL: https://artifactory.example.com/artifactory/test-ap-generic/oidc-upload-20260113135415
{
  "message": "Upload successful",
  "artifact_path": "https://artifactory.example.com/artifactory/test-ap-generic/oidc-upload-20260113135415"

}

References:

AWS IAM Outbound Federation
AWS Token Claims
Artifactory OIDC Integration