ARTIFACTORY: OIDC Setup Example

Introduction
Artifactory recently released an OIDC integration compatible with GitHub's OIDC system. This allows GitHub Actions builds to authenticate with Artifactory using secure tokens instead of direct credentials.

Setting this system up for the first time can be challenging because of the various fields that have to be entered as input. This guide aims to help you get through the initial setup in one go using an example project.
 

Step 1 - Clone and Own the Example GitHub Project

We'll be using the JFrog OIDC Integration project for this article. To make commits and to ensure the rest of the steps work, you'll have to make a clone of this project without forking it.

Before proceeding, make sure to save an access token so you can interact with GitHub securely. A token can be generated by clicking on your profile, choosing "Settings" and navigating down to "<> Developer Settings" in the bottom left menu.



Now that you have your token, we can clone and create the separate jfrog-github-oidc-example project. First, clone the public repository to a location on your developer environment:

git clone https://github.com/jfrog/jfrog-github-oidc-example.git

Second, delete the ".git" folder that came with the project:

cd jfrog-github-oidc-example; rm -r .git

Third, create the project in your GitHub account and run a "git init" to link the files to the new project:

git init
git add .
git commit -m "First Commit"
git remote add origin git@github.com:username/jfrog-github-oidc-example.git
git remote set-url origin git@github.com:username/jfrog-github-oidc-example.git
git push origin master

Back in the GitHub UI, set a secret called "JF_URL", the value of this is your Artifactory URL with "https://" in the front to specify the protocol:

Step 2 - Set up OIDC in Artifactory

The OIDC menu can be found in the JFrog Platform UI. As an admin, log in and go to Administration -> General -> Manage Integrations:



Find the "New Integration" button in the top right hand corner, and select "OpenID Connect". 

Use the preconfigured GitHub Provider Type, it fills out the Provider URL automatically. When you choose the Provider Name, ensure it matches the example project: "github" . The other string to match is the Audience, it should be "jfrog-github" for this example.





We're almost done, the last thing to configure is the Identity Mapping. The main area to complete is the claims JSON text box. This determines which GitHub repositories are allowed to access Artifactory. This syntax should be used to allow the GitHub project repository access:

{
  "iss":"https://token.actions.githubusercontent.com",
  "repository":"<org_name>/jfrog-github-oidc-example"
}

The rest of the form can be filled out by referring to this screenshot, the remaining fields are fairly straightforward:


Finally, create the repository the build will use: eks-npm, a virtual with a default npm Local Repository and a default npm Remote Repository:


 

Step 3 - Run the OIDC Build

It's time to test the OIDC GitHub Actions build! Over in the GitHub project, navigate to the "Actions" tab. GitHub Actions trigger whenever a Commit or Pull Request is detected, but you can manually trigger the build by selecting the last workflow run and choosing "Re-run all jobs" up in the right-hand corner:



Over in the Artifactory system, run a tail command on the artifactory-request.log to see the token being used by the build:

2024-06-19T22:12:18.408Z|3d1f47893b3cc611|127.0.0.1|token:oidc-admin|GET|/api/npm/npm/wrappy|304|-1|0|67|npm/7.19.0 node/v10.19.0 linux x64 workspaces/false ci/github-actions

2024-06-19T22:12:18.613Z|f3bd77e621af5248|127.0.0.1|token:oidc-admin|GET|/api/npm/npm/strip-final-newline|304|-1|0|66|npm/7.19.0 node/v10.19.0 linux x64 workspaces/false ci/github-actions

Tip: If you're seeing a 401 error on the "npm install" stage, consider removing the --global=true tag from the npm-config stage. OIDC tokens are not used when this tag is set to true.



If you run into trouble getting GitHub to connect to Artifactory, consider the troubleshooting advice in this separate article .