[Yandex Cloud documentation](../../../../index.md) > [Yandex Identity Hub](../../../index.md) > [Tutorials](../../index.md) > [Setting up single sign-on (SSO) for apps](../index.md) > Jenkins > SAML

# Creating a SAML app in Yandex Identity Hub for integration with Jenkins

[Jenkins](https://www.jenkins.io/) is an open-source Java-based software system designed to support continuous software integration.

For the users of your [organization](../../../concepts/organization.md) to be able to authenticate to Jenkins via [SAML](https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language) SSO, create a [SAML app](../../../concepts/applications.md#saml) in Yandex Identity Hub and configure it both in Yandex Identity Hub and Jenkins.

SAML apps can be managed by users with the `organization-manager.samlApplications.admin` [role](../../../security/index.md#organization-manager-samlApplications-admin) or higher.

{% note info %}

For SAML integration, your Jenkins instance must have a valid SSL certificate in place.

{% endnote %}

To give access to Jenkins to the users of your organization:

1. [Create an app in Yandex Identity Hub](#create-app).
1. [Set up the integration](#setup-integration).
1. [Make sure the application works correctly](#validate).

## Create an app in Yandex Identity Hub {#create-app}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

   1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
   1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps**.
   1. In the top-right corner, click ![Circles3Plus](../../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens:
      1. Select the **SAML (Security Assertion Markup Language)** single sign-on method.
      1. In the **Name** field, specify a name for your new app: `jenkins-saml`.

      1. Optionally, in the **Description** field, enter a description for the new app.
      1. Optionally, add [labels](../../../../resource-manager/concepts/labels.md):

         1. Click **Add label**.
         1. Add a label in `key: value` format.
         1. Press **Enter**.
      1. Click **Create application**.
   1. Save the **Metadata URL** value, you will need it at the next step.

{% endlist %}

## Set up the integration {#setup-integration}

### Install the SAML plugin in Jenkins {#install-saml-plugin}

To configure authentication to Jenkins using SAML, install the SAML plugin:

1. Log in to Jenkins as a user with administrator privileges.
1. In the left-hand menu, select **Manage Jenkins** > **Plugins**.
1. Navigate to the **Available** tab and enter `SAML` in the search bar.
1. Locate [**SAML Plugin**](https://plugins.jenkins.io/saml) and **Install** it.
1. Wait for the installation to complete, and restart Jenkins if necessary.

After you install the plugin, a new **Security Realm** option, `SAML 2.0`, will appear in the **Manage Jenkins** > **Security** section.

### Set up the SAML application in Yandex Identity Hub {#setup-idp}

#### Set up service provider endpoints {#sp-endpoints}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
  1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and then, the SAML app.
  1. At the top right, click ![pencil](../../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens:  
      1. In the **SP EntityID ** field, enter any value, e.g., `<jenkins_instance_address>/`.
      1. In the **ACS URL** field, enter `<jenkins_instance_address>/securityRealm/finishLogin`.
      1. Optionally, in the **SP Logout URL** field, enter `<jenkins_instance_address>/securityRealm/finishLogin`.
      1. Click **Save**.

{% endlist %}

### Configure authentication on the Jenkins side {#setup-sp}

1. Log in to Jenkins as a user with administrator privileges.
1. In the left-hand menu, select **Manage Jenkins** > **Security**.
1. Under **Security Realm**, select `SAML 2.0`.
1. In the **IdP Metadata URL** field, enter the metadata file address you copied earlier.
1. In the **Display Name Attribute** field, enter `fullname`.
1. In the **Username Attribute** field, enter `preferred_username`.
1. In the **Email Attribute** field, enter `emailaddress`.
1. Enable the **Advanced Configuration** option. In the **SP Entity ID** field, enter the value you specified in the **SP EntityID ** field on the Yandex Identity Hub side, e.g., `<jenkins_instance_address>/`.
1. Click **Save**.

### Configure user attributes {#user-attributes}

Add the `preferred_username` attribute to users, which will be used as the username when authenticating to Jenkins. Follow these steps:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

    1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
    1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select the desired app.
    1. Navigate to the **Attributes** tab.
    1. In the top-right corner, click ![plus](../../../../_assets/console-icons/plus.svg) **Add attribute** and in the window that opens:

        1. In the **Attribute name** field, specify `preferred_username`.
        1. In the **Value** field, select `SubjectClaims.preferred_username`.
        1. Click **Add**.

{% endlist %}

For more information about configuring attributes, see [Configure user and group attributes](../../../operations/applications/saml-create.md#setup-attributes).

### Add a user {#add-user}

For your organization's users to be able to authenticate to Jenkins with Yandex Identity Hub's SAML app, you need to explicitly add these users and/or [user groups](../../../concepts/groups.md) to the SAML application.

{% note info %}

Users and groups added to a SAML application can be managed by a user with the `organization-manager.samlApplications.userAdmin` [role](../../../security/index.md#organization-manager-samlApplications-userAdmin) or higher.

{% endnote %}

1. Add users to the application:

   {% list tabs group=instructions %}

   - Cloud Center UI {#cloud-center}

      1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization).
      1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select the required app.
      1. Navigate to the **Users and groups** tab.
      1. Click ![person-plus](../../../../_assets/console-icons/person-plus.svg) **Add users**.
      1. In the window that opens, select the required user or user group.
      1. Click **Add**.

   {% endlist %}

## Make sure your application works correctly {#validate}

To make sure both your SAML app and Jenkins integration work correctly, authenticate to Jenkins as one of the users you added to the app. Follow these steps:

1. In your browser, navigate to your Jenkins instance address.
1. You will be redirected to the Yandex Cloud authentication page. Specify the email and password for the user you added to the app. The user must also have their email address specified.
1. Make sure you have successfully authenticated to Jenkins.