Skip to content

Integrating SailPoint with Jenkins

This guide describes how to connect SailPoint to Jenkins (including CloudBees Jenkins Operations Center with managed controllers, and open-source Jenkins) so you can run test connection and dataset aggregation for governance-relevant automation and configuration objects - starting with Jenkins credentials, Jenkins controllers, and Jenkins pipelines.

Onboard Jenkins with SailPoint Agentic Fabric (SAF)

SailPoint Agentic Fabric (SAF) provides an automated, guided onboarding experience to connect your Jenkins environment to SailPoint. SAF automatically creates, deploys, and configures the Jenkins SaaS source in SailPoint, reducing the manual setup steps. After onboarding, the source is ready for aggregation and governance of Jenkins non-human identity (NHI) datasets such as credentials, pipelines, and managed controllers.

For detailed onboarding instructions, prerequisites, and connection settings, refer to Configuring the Jenkins SaaS Connector.

Important

To enable advanced governance capabilities for Jenkins resources, an active SailPoint Agentic Fabric Advanced Governance license is required. Contact your SailPoint Customer Success Manager to request access and for more information.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Configuring the Jenkins SaaS Connector

To configure the Jenkins SaaS connector in SailPoint Agentic Fabric (SAF), provide the Jenkins URL and authentication details. SAF uses these values to create and configure the Jenkins SaaS source in SailPoint so the source is ready for aggregation and governance.

To configure the Jenkins SaaS connector:

  1. In Jenkins URL, enter the HTTPS URL of the Jenkins environment SailPoint should use as the primary connection target.

  2. Set Open Source Jenkins based on your deployment.

    Note

    When enabled, the connector treats the target as a standalone open-source Jenkins instance. When disabled (default), the connector expects a CloudBees Jenkins Operations Center deployment.

CloudBees Jenkins Operations Center

When Open Source Jenkins is disabled:

  1. In Operations Center context path, enter the single path segment for the Operations Center servlet context (for example, cjoc). Do not enter a full URL.
  2. In User Id, enter the Jenkins user id used for authentication.
  3. In API Token, enter the API token from Prerequisites. Paste the full token string; it is stored as a secret in SailPoint.

Open Source Jenkins

When Open Source Jenkins is enabled:

  1. In User Id, enter the Jenkins user id used for authentication.
  2. In API Token, enter the API token from Prerequisites. Paste the full token string; it is stored as a secret in SailPoint.

To save the configuration:

  1. Select Save.

Supported Features

Feature Description
Test connection Validates reachability of the Jenkins API and the configured user credentials (User Id and API token).
Dataset aggregation Aggregates machine identities from Jenkins - for example dataset jenkins:credentials (Jenkins credentials), jenkins:controllers (Jenkins controllers), and jenkins:pipelines (Jenkins pipelines).
Exposed Credentials Jenkins scans for exposed credentials and displays them in Exposed Credentials for non-human identities in SailPoint Agentic Fabric.

Supported Version

Jenkins and supported enterprise CI distributions your organization runs (including CloudBees Jenkins Operations Center and open-source Jenkins). Verify compatibility with your environment; your Jenkins build must expose the REST endpoints this connector uses.

Non-Human Identity Discovery

  • Aggregate Jenkins credentials, controllers, and pipelines

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Prerequisites

Configure the IP Address Allow List

If a firewall or other network control limits which addresses can reach Jenkins, add the SailPoint source IP addresses for your tenant region to the allow list for the Jenkins URL. If the connector must reach managed controllers that use separate network controls, add the same addresses for those controllers. For more information, refer to IP Address Allow List in the SailPoint Developer Community documentation.

Note

These IP addresses can change. Update the allow list when the ranges change.

Create a Jenkins User API Token

SailPoint authenticates to Jenkins using a User Id and API token associated with a Jenkins account that can call the APIs required for connectivity and aggregation.

  1. Sign in to Jenkins with an account your organization approves for integration (a dedicated service account is recommended).
  2. In the user profile or security area, create a new API token (labels vary by distribution).
  3. Copy the token immediately and store it in your secrets tooling. You will paste it into the SailPoint source as API Token.
  4. Grant the account only the read-oriented access your governance program requires. Exact permissions depend on your authorization model (built-in matrix, role-based plugins, vendor RBAC, and so on). Your platform team should align grants with the datasets you enable (credentials, controllers, pipelines).
  5. If your deployment uses a central Operations Center entry point and separate managed controllers, confirm with your administrators that the same integration identity is valid for all targets the connector must reach.

For UI-specific steps and screenshots, refer to your Jenkins or vendor documentation or internal runbooks.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.