ARTIFACTORY: How to configure Artifactory OIDC Integration with Jenkins

Introduction

Artifactory’s OIDC integration allows Jenkins to authenticate with JFrog Artifactory securely without using permanent credentials, such as static passwords or long-lived API tokens.

Instead of storing high-risk credentials inside Jenkins, the pipeline establishes a short-lived, keyless trust relationship. When a pipeline runs, Jenkins generates a temporary identity token, and exchanges it with Artifactory for a short-lived access token.

This step-by-step guide walks you through establishing a secure, keyless connection between Jenkins and Artifactory using OpenID Connect (OIDC).



Step 1: Install the Jenkins OpenID Connect Provider Plugin

This plugin enables Jenkins to serve as an OpenID Connect provider, allowing it to issue identity tokens to builds for seamless, keyless authentication with external services.

Navigate to Manage Jenkins > Plugins > Available plugins in the Jenkins UI.

Search for OpenID Connect Provider and select it for installation.

Check the option to restart Jenkins after download to complete the installation process.



Step 2: Configure the Global Jenkins URL

Go to Manage Jenkins > System from the main dashboard.

Scroll down to find the Jenkins Location settings block.

Update the Jenkins URL field with your formal domain path (e.g., https://jenkins.jfrog.vm/). Note: To ensure OIDC works correctly, this endpoint must use a secure HTTPS protocol.

Click Save at the bottom of the page to apply the setting.



Step 3: Create the OIDC Credentials

Navigate to Manage Jenkins > Credentials > System > Global credentials.

```
Click Add Credentials on the left menu.
```

Choose OpenID Connect id token from the Kind dropdown list.

ID: Assign a unique reference name for the key mapping (e.g., jenkins-oidc).

Audience: Specify the identifier expected by your target platform (e.g., jfrog-aud).

Issuer URL: Leave this specific field empty to default to Jenkins. The OIDC Provider plugin automatically extracts the primary Jenkins URL from your system settings to serve as the baseline token issuer (resulting in https://jenkins.jfrog.vm/oidc).

Click Create (or OK) to store the new credentials securely.

Validate the configuration by running a test call against the local OIDC discovery API endpoint. If it is giving a “404 error”, please restart Jenkins and try again.

$curl https://jenkins.jfrog.vm/oidc/.well-known/openid-configuration
{"issuer":"https://jenkins.jfrog.vm/oidc","jwks_uri":"https://jenkins.jfrog.vm/oidc/jwks","response_types_supported":["code"],"subject_types_supported":["public"],"id_token_signing_alg_values_supported":["RS256"],"authorization_endpoint":"https://unimplemented","token_endpoint":"https://unimplemented"}



Step 4: Create OIDC Integration in Artifactory

Go to Administration > General Management > Manage Integrations in the Artifactory UI, then click New Integration and choose OpenID Connect.

Set the Provider Type selection box to Generic OpenID Connect.

Configure the Provider URL field to point to your secure issuer path: https://<Jenkins_URL>/oidc.

Specify a unique Provider Name (Record this value carefully, as you will need it later when OIDC token, e.g., jfrog-jenkins).

Add the Audience value, ensuring it exactly matches the entry used when creating the OpenID Connect id token in Jenkins (e.g., jfrog-aud).

Create the target Identity Mappings by clicking Add Identity Mapping and providing a configuration claims JSON block matching the pattern below:

{
  "sub": "https://<Jenkins_URL>/job/oidc-test-job/"
}



Step 5: Run the Pipeline Job

Once all the integration steps above are complete, create a sample pipeline project in Jenkins to test and execute the authentication process.

From the main Jenkins dashboard, click New Item, name your project, select Pipeline, and click OK.

In the pipeline configuration screen, navigate down to the Pipeline Script text box.

Add your sample script, save and perform “build with parameters”.

Note:

The pipeline job below pulls a Docker image from the Artifactory remote repository test-docker-remote using an OIDC token. For this configuration, the parameters JF_URL (https://myartifactory.vm) and JF_REGISTRY (test-docker-remote.myartifactory.vm) can be added under the This project is parameterized section of the job settings.

pipeline {
    agent any

    tools {
        jfrog 'jfrog-cli'
    }

    environment {
        JFROG_CLI_HOME_DIR = "${WORKSPACE}/.jfrog_cli_temp"
        DOCKER_CONFIG      = "${WORKSPACE}/.docker" 
    }

    stages {
        
        stage('JFrog CLI OIDC Config') {
            steps {
                withCredentials([string(credentialsId: 'jenkins-oidc', variable: 'JFROG_CLI_OIDC_EXCHANGE_TOKEN_ID')]) {
                    jf([
                        'c', 'add', 'jfrog-server',
                        "--url=${JF_URL}",
                        '--oidc-provider-name=jfrog-jenkins',
                        '--interactive=false',
                        '--overwrite'
                    ])
                }
            }
        }

        stage('Testing') {
            steps {
                jf 'c show'
                jf 'rt ping'
                jf "docker pull ${JF_REGISTRY}/nginx:latest"
            }
        }
    }

    post {
        always {
            sh 'rm -rf "$JFROG_CLI_HOME_DIR" "$DOCKER_CONFIG"'
        }
    }
}

Sample snippet from the Artifactory:

Docker image cached in Artifactory after Jenkins build:



References:

https://plugins.jenkins.io/oidc-provider/

```
OpenID Connect Integration
```