[Yandex Cloud documentation](../../../../index.md) > [Yandex Identity Hub](../../../index.md) > [Tutorials](../../index.md) > [Setting up single sign-on (SSO) for apps](../index.md) > Jenkins > OpenID Connect

# Creating an OIDC application in Yandex Identity Hub for integration with Jenkins

[Jenkins](https://www.jenkins.io/) is an open-source Java-based software system designed to support continuous software integration.

For your [organization's](../../../concepts/organization.md) users to be able to authenticate to Jenkins via OpenID Connect SSO, create an [OIDC app](../../../concepts/applications.md#oidc) in Yandex Identity Hub and configure it both in Yandex Identity Hub and Jenkins.

OIDC apps can be managed by users with the `organization-manager.oauthApplications.admin` [role](../../../security/index.md#organization-manager-oauthApplications-admin) or higher.

{% note info %}

For OIDC integration, your Jenkins instance must have a public domain and a valid SSL certificate in place.

{% endnote %}

To give the users of your organization access to Jenkins:

1. [Create an app in Yandex Identity Hub](#create-app).
1. [Set up the integration](#setup-integration).
1. [Make sure the application works correctly](#validate).

## Create an app in Yandex Identity Hub {#create-app}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

   1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
   1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps**.
   1. In the top-right corner, click ![Circles3Plus](../../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens:
      1. Select the **OIDC (OpenID Connect)** single sign-on method.
      1. In the **Name** field, specify a name for your new app: `jenkins-oidc`.
      1. In the **Folder** field, select the folder where you want to create an OAuth client for your app.
      1. Optionally, in the **Description** field, enter a description for the new app.
      1. Optionally, add [labels](../../../../resource-manager/concepts/labels.md):

         1. Click **Add label**.
         1. Specify a label in `key: value` format.
         1. Press **Enter**.
      1. Click **Create application**.
   1. On the **Overview** tab of the window that opens, copy under **Identity provider (IdP) configuration** and save the `ClientID` and `OpenID Configuration` values.
   1. Create an [app secret](../../../concepts/applications.md#oidc-secret):

      Under **App secrets**, click **Add secret**, and in the window that opens:
      
      1. Optionally, add a description for the new secret.
      1. Click **Create**.
      
      The window will display the generated [application secret](../../../concepts/applications.md#oidc-secret). Save this value.
      
      {% note warning %}
      
      If you refresh or close the application information page, you will not be able to view the secret again.
      
      {% endnote %}
      
      If you closed or refreshed the page before saving the secret, click **Add secret** to create a new one.
      
      To delete a secret, in the list of secrets on the OIDC app page, click ![ellipsis](../../../../_assets/console-icons/ellipsis.svg) in the secret row and select ![trash-bin](../../../../_assets/console-icons/trash-bin.svg) **Delete**.

{% endlist %}

## Set up the integration {#setup-integration}

### Install the OIDC plugin in Jenkins {#install-oidc-plugin}

To configure authentication to Jenkins using OIDC, install the OIDC plugin:

1. Log in to Jenkins as a user with administrator privileges.
1. In the left-hand menu, select **Manage Jenkins** > **Plugins**.
1. Navigate to the **Available** tab and enter `OpenId Connect Authentication` in the search bar.
1. Find [**OpenId Connect Authentication**](https://plugins.jenkins.io/oic-auth) and click **Install**.
1. Wait for the installation to complete, and restart Jenkins if necessary.

After installing the plugin, a new **Security Realm** option, `Login with Openid Connect`, will appear under **Manage Jenkins** > **Security**.

### Configure your OIDC application in Yandex Identity Hub {#setup-idp}

#### Configure the redirect URI {#setup-redirect}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the OIDC app.
  1. At the top right, click ![pencil](../../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:
      1. In the **Redirect URI** field, specify the authentication endpoint for your test application: `<jenkins_instance_address>/securityRealm/finishLogin`.
      1. Click **Save**.

{% endlist %}

### Configure authentication on the Jenkins side {#setup-sp}

1. Log in to Jenkins as a user with administrator privileges.
1. In the left-hand menu, select **Manage Jenkins** > **Security**.
1. Under **Security Realm**, select `Login with Openid Connect`.
1. In the **Client id** field, enter the value you copied from the **ClientID** field when setting up the OIDC application in Yandex Identity Hub.
1. In the **Client secret** field, enter the value you copied from the **App secrets** section when setting up the OIDC application in Yandex Identity Hub.
1. In the **Well-known configuration endpoint** field, enter the URL you copied from the **OpenID Configuration** field when setting up the OIDC application in Yandex Identity Hub.
1. Click **Advanced** and enter `openid email profile` in the **Override scopes** field.
1. Click **User fields** and fill in the fields as follows:
   - **User name field name**: `preferred_username`
   - **Full name field name**: `name`
   - **Email field name**: `email`
1. Click **Save**.

### Add a user {#add-user}

For your organization's users to be able to authenticate in Jenkins with Yandex Identity Hub's OIDC app, you need to explicitly add these users and/or [user groups](../../../concepts/groups.md) to the OIDC application.

{% note info %}

Users and groups added to an OIDC application can be managed by a user with the `organization-manager.oidcApplications.userAdmin` [role](../../../security/index.md#organization-manager-oidcApplications-userAdmin) or higher.

{% endnote %}

1. Add users to the application:

   {% list tabs group=instructions %}

   - Cloud Center UI {#cloud-center}

      1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
      1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select the required app.
      1. Navigate to the **Users and groups** tab.
      1. Click ![person-plus](../../../../_assets/console-icons/person-plus.svg) **Add users**.
      1. In the window that opens, select the required user or user group.
      1. Click **Add**.

   {% endlist %}

## Make sure your application works correctly {#validate}

To make sure both your OIDC app and Jenkins integration work correctly, authenticate to Jenkins as one of the users you added to the app. Follow these steps:

1. In your browser, navigate to your Jenkins instance address.
1. You will be redirected to the Yandex Cloud authentication page. Specify the email and password for the user you added to the app. The user must also have their email address specified.
1. Make sure you have successfully authenticated to Jenkins.