# SailPoint Jenkins Connector Documentation > Jenkins Connector Documentation # Documentation # Connecting SailPoint and Jenkins To connect SailPoint with Jenkins, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Select **Create Manual Work Items** to allow the connector to create manual work items for certain operations. You can also enable this option so the source supports additional source management features such as creating accounts and access profile management. > **Important** > > Once you enable this feature, you cannot disable it. For more information on manual work items in SailPoint, refer to [Work Items](). For more information on SailPoint features, refer to [SailPoint Identity Services](). 7. Select **Save**. ## Connection Settings The following values are required for SailPoint to connect to your Jenkins instance. 1. Open the source configuration and select **Connection Settings** from the menu (labels follow your connector message bundle). | Field | Description | | --- | --- | | **Jenkins URL** | HTTPS URL of the Jenkins environment SailPoint should use as the primary connection target. Use the address your administrators publish for API access. | | **Open Source Jenkins** | When enabled, the connector treats the target as a standalone open-source Jenkins instance. When disabled (default), the connector expects a CloudBees Jenkins Operations Center deployment. | | **Operations Center context path** | Enter this value when **Open Source Jenkins** is disabled. Enter a single path segment for the Operations Center servlet context (for example, `cjoc`). Do not enter a full URL. | | **User Id** | Jenkins user id used for authentication. | | **API Token** | API token from [Prerequisites](). Paste the full token string. SailPoint stores the token as a secret. | Additional connector-specific options may appear in future releases. Use values supplied by your platform team or the connector's inline help when present. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Dataset Management Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history. > [!NOTE] > > Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric]() for more information. For more information, refer to [Managing Datasets and Resources]() for datasets, resources, owner correlation, and aggregation. ## Datasets A *dataset* is a named group of one or more related resources that the source aggregates together. When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources. > [!NOTE] > > Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them. ### Dataset Aggregation Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](). ## Resources A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model. In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation. For more information, refer to [Managing Resources](). ### Owner Correlation Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](). ## Supported Datasets Go to **Dataset Management \> Datasets** on your Jenkins source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation. > [!NOTE] > > Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](). The Jenkins connector aggregates machine identities from Jenkins. The datasets are `jenkins:credentials` (Jenkins credentials), `jenkins:controllers` (Jenkins controllers), and `jenkins:pipelines` (Jenkins pipelines). | Dataset Name | Associated Resources | Dataset ID | | --- | --- | --- | | Jenkins credentials | jenkins-credentials | `jenkins:credentials` | | Jenkins controllers | jenkins-controllers | `jenkins:controllers` | | Jenkins pipelines | jenkins-pipelines | `jenkins:pipelines` | SailPoint runs a scheduled aggregation and collects the objects in the dataset. The default schedule is every 12 hours (`0 */12 * * *`). Your administrators can adjust the schedule in the tenant. For resource property and attribute definitions, refer to: - [Jenkins Credentials Attributes](<#jenkins-credentials-attributes>) - [Jenkins Controllers Attributes](<#jenkins-controllers-attributes>) - [Jenkins Pipelines Attributes](<#jenkins-pipelines-attributes>) ## Supported Resources Go to **Dataset Management \> Resources** to review the resource schemas. The connector defines each schema. You cannot edit the attributes in the UI. For more information, refer to [Managing Resources](). > [!NOTE] > > When you enable dataset aggregation for a selected dataset, the connector collects the resources in that dataset together. Activate or deactivate aggregation at the dataset level. Under **Dataset Management \> Resources**, the Jenkins source lists jenkins-credentials, jenkins-controllers, and jenkins-pipelines. Select a resource to review its schema on the **Schema** tab. | Resource Name | Resource Type | Resource ID | | --- | --- | --- | | jenkins-credentials | Credential | `jenkins:credentials` | | jenkins-controllers | Application | `jenkins:controllers` | | jenkins-pipelines | Application | `jenkins:pipelines` | **To inspect attribute names and descriptions after the source exists:** 1. Go to **Admin \> Connections \> Sources**. 2. Open your Jenkins source. 3. Select **Dataset Management \> Resources**. 4. Select a resource (for example, jenkins-credentials). 5. Open the **Schema** tab. The connector defines the attribute names, descriptions, and types. You cannot edit them on this page. Authoritative property definitions are maintained in `connector-spec.json` under `resources[]`. Published customer documentation should match what your tenant's connector package actually aggregates. ## Jenkins Credentials Attributes The following table lists schema properties for the Jenkins credentials resource (`jenkins:credentials`). | Property | Value | | --- | --- | | **Resource ID** | `jenkins:credentials` | | **Dataset ID** | `jenkins:credentials` | | **Name (UI)** | jenkins-credentials | | **Type (UI)** | Credential | | **Type (spec)** | `std:credential` | | **Identity attribute** | `fullName` | | **Display attribute** | `displayName` | ### Attributes | Attribute | Type | Required | Description | | --- | --- | --- | --- | | `fullName` | string | Yes | Full path of the credential | | `id` | string | Yes | Credential unique identifier | | `displayName` | string | Yes | Credential display name | | `typeName` | string | Yes | Credential type (for example Username with password, Secret text, SSH key) | | `description` | string | No | Credential description | | `domain` | string | Yes | Credential domain label | | `domainGlobal` | string | Yes | Indicates whether the domain is global (`true` / `false`) | | `domainFullDisplayName` | string | Yes | Domain display path | | `fingerprintTimestamp` | string | No | Fingerprint timestamp in ISO-8601 UTC when available | | `usage` | string | No | Fingerprint usage JSON listing jobs that reference the credential, when Jenkins exposes it. Credential secret values are not retrieved. | ## Jenkins Controllers Attributes The following table lists schema properties for the Jenkins controllers resource (`jenkins:controllers`). | Property | Value | | --- | --- | | **Resource ID** | `jenkins:controllers` | | **Dataset ID** | `jenkins:controllers` | | **Name (UI)** | jenkins-controllers | | **Type (UI)** | Application | | **Type (spec)** | `std:application` | | **Identity attribute** | `fullName` | | **Display attribute** | `fullName` | ### Attributes | Attribute | Type | Required | Description | | --- | --- | --- | --- | | `fullName` | string | Yes | Managed controller identifier | | `description` | string | No | Controller description | | `url` | string | No | Controller URL | | `jobs` | string\[\] | No | Top-level job names on the controller | | `nodeName` | string | No | Built-in node name | | `nodeDescription` | string | No | Built-in node description | | `numExecutors` | string | No | Executor count | | `useSecurity` | string | No | Indicates whether security is enabled | ## Jenkins Pipelines Attributes The following table lists schema properties for the Jenkins pipelines resource (`jenkins:pipelines`). | Property | Value | | --- | --- | | **Resource ID** | `jenkins:pipelines` | | **Dataset ID** | `jenkins:pipelines` | | **Name (UI)** | jenkins-pipelines | | **Type (UI)** | Application | | **Type (spec)** | `std:application` | | **Identity attribute** | `fullName` | | **Display attribute** | `displayName` | ### Attributes | Attribute | Type | Required | Description | | --- | --- | --- | --- | | `fullName` | string | Yes | Pipeline full path | | `displayName` | string | Yes | Pipeline display name | | `fullDisplayName` | string | No | Pipeline full display name | | `name` | string | No | Pipeline short name | | `jobClass` | string | Yes | Jenkins job class (for example WorkflowJob, FreeStyleProject) | | `buildable` | string | Yes | Indicates whether the pipeline is buildable | | `disabled` | string | Yes | Indicates whether the pipeline is disabled | | `description` | string | No | Pipeline description | | `jobUrl` | string | No | Pipeline URL | | `jobColor` | string | No | Pipeline status color | | `inQueue` | string | No | Indicates whether the pipeline is in queue | | `concurrentBuild` | string | No | Indicates whether concurrent builds are allowed | | `scmUrl` | string | No | Source repository URL | | `scmType` | string | No | SCM type | | `nextBuildNumber` | integer | No | Next build number | | `healthScore` | integer | No | Health score | | `healthDescription` | string | No | Health description | | `viewCredentialsCapable` | string | Yes | Indicates whether credentials view is available on the job | | `labelExpression` | string | No | Agent label expression | | `jobActionClasses` | string | Yes | Job action classes (JSON string) | | `firstBuild` | string | No | First build metadata (JSON string) | | `lastBuild` | string | No | Last build metadata (JSON string) | | `lastCompletedBuild` | string | No | Last completed build metadata (JSON string) | | `lastFailedBuild` | string | No | Last failed build metadata (JSON string) | | `lastStableBuild` | string | No | Last stable build metadata (JSON string) | | `lastSuccessfulBuild` | string | No | Last successful build metadata (JSON string) | | `lastUnstableBuild` | string | No | Last unstable build metadata (JSON string) | | `lastUnsuccessfulBuild` | string | No | Last unsuccessful build metadata (JSON string) | > [!NOTE] > > The connector filters jobs by class and aggregates supported job types. It uses folder-like containers for navigation only. In multi-controller setups, the connector adds a controller-scoped prefix to pipeline identities when job names are shared. # Integrating SailPoint with Jenkins This guide describes how to connect SailPoint to Jenkins (including CloudBees Jenkins Operations Center with managed controllers, and open-source Jenkins) so you can run test connection and dataset aggregation for governance-relevant automation and configuration objects - starting with Jenkins credentials, Jenkins controllers, and Jenkins pipelines. ## Onboard Jenkins with SailPoint Agentic Fabric (SAF) SailPoint Agentic Fabric (SAF) provides an automated, guided onboarding experience to connect your Jenkins environment to SailPoint. SAF automatically creates, deploys, and configures the Jenkins SaaS source in SailPoint, reducing the manual setup steps. After onboarding, the source is ready for aggregation and governance of Jenkins non-human identity (NHI) datasets such as credentials, pipelines, and managed controllers. For detailed onboarding instructions, prerequisites, and connection settings, refer to [Configuring the Jenkins SaaS Connector](<#configuring-the-jenkins-saas-connector>). > [!IMPORTANT] > > To enable advanced governance capabilities for Jenkins resources, an active SailPoint Agentic Fabric Advanced Governance license is required. Contact your SailPoint Customer Success Manager to request access and for more information. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Configuring the Jenkins SaaS Connector To configure the Jenkins SaaS connector in SailPoint Agentic Fabric (SAF), provide the Jenkins URL and authentication details. SAF uses these values to create and configure the Jenkins SaaS source in SailPoint so the source is ready for aggregation and governance. **To configure the Jenkins SaaS connector:** 1. In **Jenkins URL**, enter the HTTPS URL of the Jenkins environment SailPoint should use as the primary connection target. 2. Set **Open Source Jenkins** based on your deployment. > **Note** > > When enabled, the connector treats the target as a standalone open-source Jenkins instance. When disabled (default), the connector expects a **CloudBees Jenkins Operations Center** deployment. ### CloudBees Jenkins Operations Center **When Open Source Jenkins is disabled:** 1. In **Operations Center context path**, enter the single path segment for the Operations Center servlet context (for example, `cjoc`). Do not enter a full URL. 2. In **User Id**, enter the Jenkins user id used for authentication. 3. In **API Token**, enter the API token from [Prerequisites](<#prerequisites>). Paste the full token string; it is stored as a secret in SailPoint. ### Open Source Jenkins **When Open Source Jenkins is enabled:** 1. In **User Id**, enter the Jenkins user id used for authentication. 2. In **API Token**, enter the API token from [Prerequisites](<#prerequisites>). Paste the full token string; it is stored as a secret in SailPoint. **To save the configuration:** 1. Select **Save**. ## Supported Features | Feature | Description | | --- | --- | | Test connection | Validates reachability of the Jenkins API and the configured user credentials (User Id and API token). | | Dataset aggregation | Aggregates machine identities from Jenkins - for example dataset `jenkins:credentials` (Jenkins credentials), `jenkins:controllers` (Jenkins controllers), and `jenkins:pipelines` (Jenkins pipelines). | | Exposed Credentials | Jenkins scans for exposed credentials and displays them in Exposed Credentials for non-human identities in SailPoint Agentic Fabric. | ### Supported Version Jenkins and supported enterprise CI distributions your organization runs (including CloudBees Jenkins Operations Center and open-source Jenkins). Verify compatibility with your environment; your Jenkins build must expose the REST endpoints this connector uses. ### Non-Human Identity Discovery - Aggregate Jenkins credentials, controllers, and pipelines Refer to Dataset Management for more information. Refer to [Discovering Potential Non-Human Accounts]() for more information. ## Prerequisites ### Configure the IP Address Allow List If a firewall or other network control limits which addresses can reach Jenkins, add the SailPoint source IP addresses for your tenant region to the allow list for the **Jenkins URL**. If the connector must reach managed controllers that use separate network controls, add the same addresses for those controllers. For more information, refer to [IP Address Allow List]() in the SailPoint Developer Community documentation. > [!NOTE] > > These IP addresses can change. Update the allow list when the ranges change. ### Create a Jenkins User API Token SailPoint authenticates to Jenkins using a **User Id** and **API token** associated with a Jenkins account that can call the APIs required for connectivity and aggregation. 1. Sign in to Jenkins with an account your organization approves for integration (a dedicated service account is recommended). 2. In the user profile or security area, create a new API token (labels vary by distribution). 3. Copy the token immediately and store it in your secrets tooling. You will paste it into the SailPoint source as **API Token**. 4. Grant the account only the read-oriented access your governance program requires. Exact permissions depend on your authorization model (built-in matrix, role-based plugins, vendor RBAC, and so on). Your platform team should align grants with the datasets you enable (credentials, controllers, pipelines). 5. If your deployment uses a central Operations Center entry point and separate managed controllers, confirm with your administrators that the same integration identity is valid for all targets the connector must reach. For UI-specific steps and screenshots, refer to your Jenkins or vendor documentation or internal runbooks. # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Test connection fails **Resolution**: Verify the **Jenkins URL**, **User Id**, **API Token**, TLS trust, and network access from SailPoint to your Jenkins endpoint. If a firewall limits access to Jenkins, confirm the SailPoint source IP addresses are on the allow list. Refer to [Prerequisites](). When **Open Source Jenkins** is disabled, confirm the **Operations Center context path** is a single path segment (for example `cjoc`) and not a full URL. Confirm the API token is valid and the integration account has permission to call the Jenkins REST APIs (including `whoAmI`). ## Dataset aggregation returns no data **Resolution**: Confirm dataset aggregations are started or scheduled under **Dataset Management** for `jenkins:credentials`, `jenkins:controllers`, and `jenkins:pipelines`. Verify the integration account can read the system credentials store, Operations Center managed controller catalog (when applicable), and job tree APIs on each target Jenkins instance. ## Dataset aggregation fails or times out **Resolution**: On large CloudBees Jenkins Operations Center deployments, aggregation may take longer to complete across managed controllers. If aggregation fails with `command invocation expired`, retry during a maintenance window, reduce concurrent load on the Jenkins controllers, or contact SailPoint Support with connector debug logging enabled. ## Pipelines or credentials missing from managed controllers **Resolution**: Verify **Operations Center context path** and that the integration account can reach each managed controller's credentials store and job tree. Confirm pipeline identities include the controller scope prefix (for example `kaizen/job-name`) where your deployment uses shared job names across CJOC and controllers. ## Jenkins returned HTML instead of JSON **Resolution**: This usually indicates an incorrect **Jenkins URL** or **Operations Center context path**, or a redirect to a login page. Verify the URL your administrators publish for API access and that the integration account authenticates successfully outside SailPoint. ## Enable connector debug logging **Resolution**: Enable **Enable debug logging** and set an appropriate **Debug log expiry**. Re-run **Test connection** or dataset aggregation, then collect connector logs for SailPoint Support if issues persist.