Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Creating an OIDC application in Yandex Identity Hub for integration with Jenkins

Written by
Updated at July 16, 2026
View in Markdown

Jenkins is an open-source Java-based software system designed to support continuous software integration.

For the users of your organization to be able to authenticate to Jenkins via OpenID Connect SSO, create an OIDC app and configure it both in Yandex Identity Hub and Jenkins.

OIDC apps can be managed by users with the organization-manager.oauthApplications.admin role or higher.

Note

For OIDC integration, your Jenkins instance must have a public domain and a valid SSL certificate in place.

To give access to Jenkins to the users of your organization:

  1. Create an app in Yandex Identity Hub.
  2. Set up the integration.
  3. Make sure the application works correctly.

Create an app in Yandex Identity Hub

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps.

  3. In the top-right corner, click Create application and in the window that opens:

    1. Select the OIDC (OpenID Connect) single sign-on method.

    2. In the Application type field, select Web Application.

      OIDC apps of the Web Application type are optimized for user authentication to external web apps with a server end (backend), where the application secret can be safely stored. For more information about OIDC application types, see Types of OIDC apps in Yandex Identity Hub.

    3. In the Name field, specify a name for your new app: jenkins-oidc.

    4. In the Folder field, select the folder where you want to create an OAuth client for your app.

    5. Optionally, in the Description field, enter a description for the new app.

    6. Optionally, add labels:

      1. Click Add label.
      2. Add a label in key: value format.
      3. Press Enter.

    7. Click Create application.

  4. On the Overview tab of the window that opens, copy under Identity provider (IdP) configuration and save the ClientID and OpenID Configuration values.

  5. Create an app secret:

    Create an app secret (only available for applications of the Web Application type):

    1. Under App secrets, click Add secret, and in the window that opens:

      1. Optionally, add a description for the new secret.
      2. Click Create.

    The window will display the generated application secret. Save this value.

    Warning

    If you refresh or close the application information page, you will not be able to view the secret again.

    If you closed or refreshed the page before saving the secret, click Add secret to create a new one.

    To delete a secret, in the list of secrets on the OIDC app page, click in the secret row and select Delete.

Set up the integration

Install the OIDC plugin in Jenkins

To configure authentication to Jenkins using OIDC, install the OIDC plugin:

  1. Log in to Jenkins as a user with administrator privileges.
  2. In the left-hand menu, select Manage Jenkins > Plugins.
  3. Navigate to the Available tab and enter OpenId Connect Authentication in the search bar.
  4. Find OpenId Connect Authentication and click Install.
  5. Wait for the installation to complete, and restart Jenkins, if required.

After installing the plugin, a new Security Realm option, Login with Openid Connect, will appear under Manage Jenkins > Security.

Configure your OIDC application in Yandex Identity Hub

Configure the redirect URI

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and select the OIDC app.
  3. At the top right, click Edit and in the window that opens:
    1. In the Redirect URI field, specify the authentication endpoint for your test application: <jenkins_instance_address>/securityRealm/finishLogin.
    2. Click Save.

Configure authentication on the Jenkins side

  1. Log in to Jenkins as a user with administrator privileges.
  2. In the left-hand menu, select Manage Jenkins > Security.
  3. Under Security Realm, select Login with Openid Connect.
  4. In the Client id field, enter the value you copied from the ClientID field when setting up the OIDC application in Yandex Identity Hub.
  5. In the Client secret field, enter the value you copied from the App secrets section when setting up the OIDC application in Yandex Identity Hub.
  6. In the Well-known configuration endpoint field, enter the URL you copied from the OpenID Configuration field when setting up the OIDC application in Yandex Identity Hub.
  7. Click Advanced and enter openid email profile in the Override scopes field.
  8. Click User fields and fill in the fields as follows:
    • User name field name: preferred_username
    • Full name field name: name
    • Email field name: email
  9. Click Save.

Add a user

For your organization's users to be able to authenticate in Jenkins with Yandex Identity Hub's OIDC app, you need to explicitly add these users and/or user groups to the OIDC application.

Note

Users and groups added to an OIDC application can be managed by a user with the organization-manager.oidcApplications.userAdmin role or higher.

  1. Add users to the application:

    1. Log in to Yandex Identity Hub.
    2. In the left-hand panel, select Apps and select the required app.
    3. Navigate to the Users and groups tab.
    4. Click Add users.
    5. In the window that opens, select the required user or user group.
    6. Click Add.

Tip

If you want to fine-tune user authentication in your applications, including authentication only from specific IP addresses, use authentication policies.

Authentication policies are a Yandex Identity Hub tool that allows you to flexibly configure access to applications by denying or allowing authentication for specific users in specific applications and/or from specific IP addresses. For more information, see Authentication policies in Yandex Identity Hub.

Make sure your application works correctly

To make sure both your OIDC app and Jenkins integration work correctly, authenticate to Jenkins as one of the users you added to the app. Proceed as follows:

  1. In your browser, navigate to your Jenkins instance address.
  2. You will be redirected to the Yandex Cloud authentication page. Specify the email and password for the user you added to the app. The user must also have their email address specified.
  3. Make sure you have successfully authenticated to Jenkins.
Previous
SAML
Next
Managed Service for GitLab