Jenkins: SAML Authentication with Okta and users groups
Tags: devops, jenkins, security
Published: 2019-10-12 07:05:16

---
title: Jenkins: SAML Authentication with Okta and users groups
published: true
date: 2019-10-11 14:53:55 UTC
tags: devops,Jenkins,Security
canonical_url: https://rtfm.co.ua/en/jenkins-saml-authentication-via-okta-and-users-groups/
---

![](https://rtfm.co.ua/wp-content/uploads/2016/01/Jenkins.sh-600x600-e1453134979914.png) **SAML** – _Secure Assertion Markup Language_ used for federated authentication when some service which we need to get access to (a _Service Provider_), asks another service (an _Identity Provider_) to perform a user’s authentication.

Check the documentation [here>>>](https://www.okta.com/integrate/documentation/saml/).

- _Service Provider_ ( **SP** ): is a system where need to authenticate, in our case this will be Jenkins
- _Identity Provider (_ **IdP** _)_: is a system where users are stored and which will perform exactly authentication steps, in our case this will be Okta

Their communication and steps during authentication can be displayed in the next scheme:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/saml_guidance_saml_flow.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/saml_guidance_saml_flow.png)

Here:

- _SAML Request_: or authentication request, created by an SP to request a user’s authentication
- _SAML Response_: will be created by an IdP and contains data about an already authenticated user and may include some additional information like user’s groups and so on

Also, keep in mind that SAML-authentication can be two types:

- _A Service Provider Initiated (SP-initiated)_: a service, Jenkins in this case, performs initialization to an IdP provider when a user tries to log in to the Jenkins instance
- _An Identity Provider Initiated (IdP-initiated)_: and vise versa – when Okta’s user will click on a button to log in to the Jenkins – IdP will initialize a request to the Jenkins (SP) to authenticate this user

In this post mostly will speak about _Service Provider Initiated,_ but still, _Identity Provider Initiated_ will work as well.

Also, keep in mind that an SP and an IdP will never talk directly to each other – a user’s browser will act like a “proxy” between them.

### A Service Provider role

An IdP generates a SAML response for an SP and then SP has to check if this response was received from a valid IdP and then parse this response to get necessary data – a user’s name, groups, and other attributes.

To do so an SP need to obtain the next information from an IdP:

- an IdP’s public certificate
- _ACS Endpoint_ (_Assertion Consumer Service URL_) or just “SP login URL” – an endpoint URL passed by an SP to an IdP to receive SAML replies
- _IdP Login URL_ – an IdP’s endpoint where SP will send its SAML requests

### Jenkins SAML for Okta

The main goal in the SAML integration to the Jenkins is:

- store users in Okta
- Okta’s users are grouped to groups
- Jenkins will use a Role-Based Strategy plugin which will have access roles assigned to various groups

In Okta Jenkins SAML can be configured in two ways:

1. by using a native Okta’s application – less work for configuration, but has no ability to pass user’s groups to Jenkins, will be covered in the [Okta Community Created Jenkins SAML application](https://rtfm.co.ua/en/jenkins-saml-authentication-via-okta-and-users-groups/#Okta_Community_Created_Jenkins_SAML_application "Okta Community Created Jenkins SAML application") part of this post
2. or by creating an own SAML-based application in Okta which will have a custom attribute with user group field will be reviewed in the [Okta and own application for Jenkins SAML](https://rtfm.co.ua/en/jenkins-saml-authentication-via-okta-and-users-groups/#Okta_and_own_application_for_Jenkins_SAML "Okta and own application for Jenkins SAML") part of this post

With the first way you’ll be unable to use the [Role-Based Strategy](https://wiki.jenkins.io/display/JENKINS/Role+Strategy+Plugin) plugin but still can use a [Matrix-based security](https://wiki.jenkins.io/display/JENKINS/Matrix-based+security) or [Matrix Authorization Strategy](https://wiki.jenkins.io/display/JENKINS/Matrix+Authorization+Strategy+Plugin) plugins:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_140825.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_140825.png)The Role-Based plugin configuration will be described in the following parts and now in the post will see how to configure Okta and SAML for Jenkins in both ways mentioned above.

#### Okta native Jenkins SAML application

##### Okta configuration

Go to the Okta > _Add app,_ find an Jenkins SAML plugin:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132458.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132458.png)

Set a Jenkins’ URL:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132545.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132545.png)

Switch to the _Sign On_ tab:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132830.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132830.png)

Click on the _View Setup Instructions_ – Okta already has all data generated here to be used by our SP (Jenkins):

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132917.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132917.png)

Go to the _Assignment_ tab and add the Jenkins SAML app to desired Okta’s users:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_134707.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_134707.png)Navigate to your Jenkins.

##### SAML configuration in Jenkins

Install the [SAML plugin](https://wiki.jenkins.io/display/JENKINS/SAML+Plugin):

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132100.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_132100.png)

Go to the _Configure Global Security_, switch your authentication realm from the _Jenkins’ own user database_ to the _SAML_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_133027.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_133027.png)

Go back to Okta and the metadata page, copy the _IdP Metadata_ content:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_114649.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_114649.png)

Paste to the Jenkins’ SAML settings:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_114056-1.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_114056-1.png)

Return to your Okta, copy link to the _Identity Provider metadata_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_144958.png)](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_144958.png)

Set it in Jenkins to the _IdP Metadata URL_ field:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_115014.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_115014.png)

_Display Name Attribute_ and _Group Attribute_ leave as is.

Check it now: open your Jenkins URL – you must be redirected to Okta:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_152851.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191004_152851.png)Log in, all done here.

#### Okta and own application for Jenkins SAML

Now let’s add a new application in Okta which will be able to pass a user’s group to Jenkins, for example – a _DevOps_ group:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_142226.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_142226.png)

##### Okta configuration

Crateate a new application:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_123217.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_123217.png)

Set its name, icon:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_123319.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_123319.png)

Next, in the _Single sign on URL_ и _Audience URI (SP Entity ID)_ set _ACS Endpoint_ – _http://dev.ci.example.com/securityRealm/finishLogin_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_124344.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_124344.png)

To pass user groups from Okta to Jenkins add a new field in the _GROUP ATTRIBUTE STATEMENTS (OPTIONAL)_:

- `Name`: _Group_
- `Name format`: _Basic_
- `Filter` – _Matches regex_ and value as .\* to apply to all Okta’s groups

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_124030.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_124030.png)

On the next page set _I’m an Okta customer adding an internal app_, and _Finish_.

Do not forget about _Assignments_.

Now, in the same way, as we did previously, click on the _View Setup Instructions_, copy IdP_ metadata_ and update _Configure Global Security_ settings in Jenkins.

Copy a link to the _Identity Provider metadata_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_125458.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_125458.png)

##### SAML configuration in Jenkins

Set this link to the _IDP Metadata URL_ filed in Jenkins:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_125621.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_125621.png)

In Jenkins change the _Group Attribute’_s value from the _http://schemas.xmlsoap.org/claims/Group_ to just “_Group”_:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_134506.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_134506.png)Actually, that’s all folks.

### Jenkins Role-based Security

Going forward a bit (will add another post about Role-based plugin configuration) – an example of Role-based Security and groups in Jenkins.

A user in Okta and its groups:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_142226.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_142226.png)

Roles in Jenkins:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_145739.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_145739.png)

And a group _DevOps_ with a _test_ assigned:

[![](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_134633.png "Jenkins: SAML Authentication через Okta")](https://rtfm.co.ua/wp-content/uploads/2019/10/Screenshot_20191011_134633.png)

Done.

### Useful links

- [How do I setup OKTA as Identity Provider in Jenkins?](https://support.cloudbees.com/hc/en-us/articles/115000105752-How-do-I-setup-OKTA-as-Identity-Provider-in-Jenkins-)
- [How SAML Authentication Works](https://auth0.com/blog/how-saml-authentication-works/)

### Similar posts

- <small>09/30/2019</small> [Okta: SSO authentication for Gmail and Slack](https://rtfm.co.ua/en/okta-sso-authentication-for-gmail-and-slack/)
- <small>02/09/2017</small> [Azure: подключение дополнительного диска к VM и миграция Jenkins](https://rtfm.co.ua/azure-podklyuchenie-dopolnitelnogo-diska-k-vm-i-migraciya-jenkins/)  
- <small>04/16/2019</small> [Jenkins: a job to check a Github organization’s public repositories list](https://rtfm.co.ua/en/jenkins-a-job-to-check-a-github-organizations-public-repositories-list/)