Jenkins SSO: the Casdoor plugin, or any OIDC provider

Jenkins does not ship with OpenID Connect support. To get single sign-on, you install a plugin: either the Casdoor plugin, which is purpose-built for Casdoor, or the generic OpenId Connect Authentication plugin (oic-auth), which works with any OIDC provider.

Both routes end in the same place: users sign in at the identity provider and Jenkins creates a session from the returned claims. The difference is how much of the configuration is handled for you.

Which route to choose

If Casdoor is your identity provider and you want the shortest setup, use the Casdoor plugin. If you may switch providers later, the generic plugin keeps Jenkins provider-agnostic.

Before you start

1. Set the Jenkins URL under Manage Jenkins → Configure System → Jenkins Location. Jenkins builds the callback from this value, so it must be the public URL users reach.
2. Back up Jenkins' config.xml. A security realm change that goes wrong can lock you out.
3. In Casdoor, set the origin in conf/app.conf to the public Casdoor URL if it is behind a proxy. The issuer in the discovery document must match the URL Jenkins uses.

The redirect URL is the same for both plugins:

https://<jenkins-host>/securityRealm/finishLogin

Route A: the Casdoor plugin

1. In Casdoor, create an application for Jenkins and add the redirect URL above. Note the client ID and client secret.
2. Install the Casdoor plugin from the Jenkins plugin manager, or upload the plugin JAR.
3. Open Manage Jenkins → Configure Global Security.
4. In the Security Realm section, select Casdoor Authentication Plugin.
5. Fill in the Casdoor endpoint, client ID and client secret.
6. Copy the JWT public key from the application's certificate in Casdoor and paste it into the plugin's JWT Public Key field.
7. Organization Name and Application Name are optional; they restrict verification to a specific organization or application. Leave them empty to use the default.
8. In Authorization, choose the policy you want. For a first test, "Logged-in users can do anything" is the simplest; disable anonymous read access.
9. Save. Jenkins should redirect to Casdoor on the next login.

Route B: the generic OIDC plugin

1. In the identity provider, create an application with the redirect URL above. Note the client ID and secret.
2. Install the OpenId Connect Authentication plugin from the Jenkins plugin manager.
3. Open Manage Jenkins → Configure Global Security.
4. In Access Control, select Login with Openid Connect as the Security Realm.
5. Enter the client ID and client secret.
6. In Configuration mode, choose Automatic configuration and enter the discovery URL:

https://<casdoor-host>/.well-known/openid-configuration

If Jenkins cannot reach the discovery URL, choose Manual configuration and enter the endpoints from the discovery document:

7. In Advanced settings, map the claims: User name = preferred_username, Full name = name, Email = email.
8. In Authorization, enable "Logged-in users can do anything" for the first test and disable anonymous read access.
9. Save and test the login.

For Keycloak or Entra ID, the discovery URL and claim names differ slightly; use the provider's discovery document and its documented claim names. The oic-auth plugin's automatic configuration reads the endpoints from discovery, so the main thing to get right is the issuer URL.

Troubleshooting

FAQ

Does Jenkins support SAML? Jenkins itself does not; SAML support comes from plugins. If your IdP speaks SAML, either use a SAML plugin or put a broker in front of Jenkins that exposes OIDC.

Can I keep local Jenkins accounts? Yes, but mixing local accounts with SSO is a common source of lockouts. Keep one emergency local admin, document it, and make sure it is protected. Do not leave the default admin password in place.

How do I map IdP groups to Jenkins roles? The oic-auth plugin exposes groups through the security realm; combine it with the Role-based Authorization Strategy or the Matrix Authorization Strategy plugin. The Casdoor plugin can also restrict by organization and application.

Why does the Casdoor plugin need a JWT public key? The plugin verifies the token signature locally with the application's public key. If the key does not match the certificate used to sign the token, Jenkins rejects the login.

If you want one identity provider for Jenkins and the rest of your toolchain, Casdoor speaks OIDC, SAML, CAS, LDAP and SCIM, and has a Jenkins plugin. Casdoor Cloud starts at $6.67/month billed yearly for a dedicated instance. See the Casdoor Jenkins plugin guide for the exact fields.