Contact UsTry it for free
© 2026 Direct Cursus Technology L.L.C.

Creating an OIDC application in Yandex Identity Hub for integration with Jenkins

Written by
Updated at May 8, 2026

Jenkins is an open-source Java-based software system designed to support continuous software integration.

For your organization's users to be able to authenticate to Jenkins via OpenID Connect SSO, create an OIDC app in Yandex Identity Hub and configure it both in Yandex Identity Hub and Jenkins.

OIDC apps can be managed by users with the organization-manager.oauthApplications.admin role or higher.

Note

For OIDC integration, your Jenkins instance must have a public domain and a valid SSL certificate in place.

To give the users of your organization access to Jenkins:

  1. Create an app in Yandex Identity Hub.
  2. Set up the integration.
  3. Make sure the application works correctly.

Create an app in Yandex Identity Hub

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps.

  3. In the top-right corner, click Create application and in the window that opens:

    1. Select the OIDC (OpenID Connect) single sign-on method.

    2. In the Name field, specify a name for your new app: jenkins-oidc.

    3. In the Folder field, select the folder where you want to create an OAuth client for your app.

    4. Optionally, in the Description field, enter a description for the new app.

    5. Optionally, add labels:

      1. Click Add label.
      2. Specify a label in key: value format.
      3. Press Enter.

    6. Click Create application.

  4. On the Overview tab of the window that opens, copy under Identity provider (IdP) configuration and save the ClientID and OpenID Configuration values.

  5. Create an app secret:

    Under App secrets, click Add secret, and in the window that opens:

    1. Optionally, add a description for the new secret.
    2. Click Create.

    The window will display the generated application secret. Save this value.

    Warning

    If you refresh or close the application information page, you will not be able to view the secret again.

    If you closed or refreshed the page before saving the secret, click Add secret to create a new one.

    To delete a secret, in the list of secrets on the OIDC app page, click in the secret row and select Delete.

Set up the integration

Install the OIDC plugin in Jenkins

To configure authentication to Jenkins using OIDC, install the OIDC plugin:

  1. Log in to Jenkins as a user with administrator privileges.
  2. In the left-hand menu, select Manage Jenkins > Plugins.
  3. Navigate to the Available tab and enter OpenId Connect Authentication in the search bar.
  4. Find OpenId Connect Authentication and click Install.
  5. Wait for the installation to complete, and restart Jenkins if necessary.

After installing the plugin, a new Security Realm option, Login with Openid Connect, will appear under Manage Jenkins > Security.

Configure your OIDC application in Yandex Identity Hub

Configure the redirect URI

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and then, the OIDC app.
  3. At the top right, click Edit and in the window that opens:
    1. In the Redirect URI field, specify the authentication endpoint for your test application: <jenkins_instance_address>/securityRealm/finishLogin.
    2. Click Save.

Configure authentication on the Jenkins side

  1. Log in to Jenkins as a user with administrator privileges.
  2. In the left-hand menu, select Manage Jenkins > Security.
  3. Under Security Realm, select Login with Openid Connect.
  4. In the Client id field, enter the value you copied from the ClientID field when setting up the OIDC application in Yandex Identity Hub.
  5. In the Client secret field, enter the value you copied from the App secrets section when setting up the OIDC application in Yandex Identity Hub.
  6. In the Well-known configuration endpoint field, enter the URL you copied from the OpenID Configuration field when setting up the OIDC application in Yandex Identity Hub.
  7. Click Advanced and enter openid email profile in the Override scopes field.
  8. Click User fields and fill in the fields as follows:
    • User name field name: preferred_username
    • Full name field name: name
    • Email field name: email
  9. Click Save.

Add a user

For your organization's users to be able to authenticate in Jenkins with Yandex Identity Hub's OIDC app, you need to explicitly add these users and/or user groups to the OIDC application.

Note

Users and groups added to an OIDC application can be managed by a user with the organization-manager.oidcApplications.userAdmin role or higher.

  1. Add users to the application:

    1. Log in to Yandex Identity Hub.
    2. In the left-hand panel, select Apps and select the required app.
    3. Navigate to the Users and groups tab.
    4. Click Add users.
    5. In the window that opens, select the required user or user group.
    6. Click Add.

Make sure your application works correctly

To make sure both your OIDC app and Jenkins integration work correctly, authenticate to Jenkins as one of the users you added to the app. Follow these steps:

  1. In your browser, navigate to your Jenkins instance address.
  2. You will be redirected to the Yandex Cloud authentication page. Specify the email and password for the user you added to the app. The user must also have their email address specified.
  3. Make sure you have successfully authenticated to Jenkins.
Previous
SAML
Next
Using OAuth2 Proxy for applications not supporting SSO