SAML Single Sign On (SSO) into Jenkins using Azure AD as IDP

Jenkins SAML app gives the ability to enable SAML Single Sign-On for Jenkins. Here we will go through a guide to configure SSO between Jenkins and Azure AD. By the end of this guide, Azure AD users should be able to log in and register to Jenkins.

Step 1: Setup Azure AD as Identity Provider

    Single Sign On into JIRA using AzureAD, AzureAD SSO Login-1 Prerequisites:

    Copy these values from the Service Provider Info tab of the SAML plugin.

    • SP Entity ID
    • ACS URL

    Single Sign On into JIRA using AzureAD, AzureAD SSO Login-2 Instructions:

    Note: Enterprise app configuration is the recommended option for SAML . If you do not have Azure subscription or using free account please setup App Registration Configuration.

    To perform Single Logout using Azure AD, the Atlassian instance (E.g. Jira, Confluence) must be https enabled.

  • Log in to Azure AD Portal

  • Select Azure Active Directory ⇒ App Registrations. Click on New Application Registration.

  •  Azure AD SAML SSO New app
  • Assign a Name and choose the account type. In the Redirect URI field, provide the ACS URL provided in Service Provider Info tab of the plugin and click on Register button.
  •       Azure AD SAML SSO app registration
  • Now, navigate to Expose an API menu option and click the Set button and replace the APPLICATION ID URI with the plugin's SP Entity ID

  • Azure AD SAML SSO expose an API
  • By default, some Attributes will be sent in the SAML token. If you're not getting group information. Then, add Token configuration for Group information.

  • Azure AD SAML SSO token configuration
  • Click on Add groups claim
  • Azure AD SAML SSO Add groups claim
  • Go back to Azure Active Directory ⇒ App Registrations window and click on Endpoints link.

  • Azure AD SAML SSO Endpoints
  • This will open up a window with multiple URLs listed there. Copy the Federation Metadata Document URL. This will be required while configuring the SAML plugin.

  • Azure AD SAML SSO federation metadata document
  • Log in to Azure AD Portal

  • Select ⇒ and Azure Active Directory ⇒ Enterprise Applications.

  • Azure AD SAML SSO enterprise application
  • Click on New Application.

  • Azure AD SAML SSO new application
  • Click on Non-gallery application section and enter the name for your app and click on Add button.

  • Azure AD SAML SSO Non gallery application
  • Click on Single sign-on from the application's left-hand navigation menu. The next screen presents the options for configuring single sign-on. Click on SAML.

  • Azure AD SAML SSO select saml
  • Edit the option 1 :Basic SAML Configuration to configure plugin endpoints.
  • Enter the SP Entity ID for Identifier and the ACS URL for Reply URL from Service Provider Info tab of the plugin.

  • Azure AD SAML SSO saml configuration
  • Click on Save icon.
  • Azure AD SAML SSO save window
  • By default, the following Attributes will be sent in the SAML token. You can view or edit the claims sent in the SAML token to the application under the User Attributes & Claims tab.
  • You can add attribute using Add new claim
  •  Azure AD SAML SSO user attributes claims
  • You can add group attribute claim using Add a group claim
  • Azure AD SAML SSO add a group claim
  • Copy App Federation Metadata Url from setup tab.

  • Azure AD SAML SSO federation metadata URL
  • Click on User and groups from the applications left-hand navigation menu. The next screen presents the options for assigning the users/groups to the application.

  • Azure AD SAML SSO user and groups

Step 2: Download and install the plugin in Jenkins.

    To Setup the miniorange saml SP plugin follow the path:

  • Download miniorange_saml.hpi file.
  • Login to your Jenkins Admin Account.


  • manage jenkins-1

  • Go to Manage Jenkins option from the left pane, and open Manage Plugins tab.


  • manage plugins-2

  • Go to the advanced tab and upload the hpi file.


  • upload plugin-3

  • Follow the instructions shown on screen and restart the Jenkins.


  • install plugins-4

Step 3: Activate the plugin

  • Open Manage Jenkins and select Configure Global Security.


  • configure security-5

  • Set the Security Realm as miniorange SAML 2.0.


  • security realm-6

  • Make sure that Enable Security checkbox is checked.
Manual Configuration

To Configure IDP enter the following details and press apply and save the settings.

  • IDP Entity ID
  • Single Sign On URL
  • Name ID Format
  • X.509 Certificate
  • Username Attribute
  • Email Attribute
idp metadata -6

SP Configurations

  • To Configure SP Settings at IDP copy below URL and paste in respective fields at IDP end.
    • ACS URL: https://your-jenkins-domain/securityRealm/moSamlAuth
    • Audience URI: https://your-jenkins-domain
    • SP Entity ID: https://your-jenkins-domain
    • sp metadata -7


If you want to auto create users through Single Sign On, check Do you want to create users? check box.


Manual Configuration

To Configure IDP enter the following details and press apply and save the settings.

  • IDP Entity ID
  • Single Sign On URL
  • Single Logout URL
  • Name ID Format
  • X.509 Certificate
  • Username Attribute
  • Email Attribute
  • idp metadata -6


Attribute Mapping

  • Attribute Mapping feature allows you to map the user attributes sent by the IDP during SSO to the user attributes at Jenkins.
  • In Jenkins miniOrange SAML SP plugin, go to Attribute Mapping section and fill up the following fields.
    • Username Attribute
    • Email Attribute
    • Full Name Attribute
    • attribute mapping-8
  • Select the option as username/email in Login Jenkins Account by: as per your account in Jenkins.
  • If you don't want existing users attribute to update keep the Do not update Attributes of existing users checkbox unchecked.
  • To Add custom Attribute select Add option.
    • Set Attribute Name as the one set in IDP eg. lname
    • Set display name in user proprties as one you want it appear in jenkins user's config.xml file and in user's configure tab.
  • Paste URL that users will be redirected after logout in Custom Logout URL tab.


SP Configurations

  • To Configure SP Settings at IDP copy below URL and paste in respective fields at IDP end.
    • SP Entity ID: https://your-jenkins-domain/securityRealm/moSamlAuth
    • Audience URI: https://your-jenkins-domain/securityRealm/moSamlAuth
    • ACS URL: https://your-jenkins-domain
    • sp metadata -7


Advanced Settings

    advance settings -9
  • Binding Types for Authentication and Logout Request:
    • Set the binding type as Http-Redirect or Http-Post to send requests in redirect or post format.
  • Keep the check boxes for signed request and user creation as per your requirement.
  • Auto-Redirection from Jenkins Login:
    • If do you want to Auto Redirect to IDP option is enabled, any unauthenticated user trying to access the default Jenkins login page will get redirected to the IDP login page for authentication. After successful authentication, they will be redirected back to the Jenkins base URL.
    • Copy backdoor URL and save it for emergency.