Jenkins

Proxy for a Jenkins controller through the managed gateway. Routes use a non-terminal path wildcard, so any nested job URL (/job/foo/job/bar/...) is accepted and gated by PBAC policy.

Authentication

Jenkins does not accept IdP-issued OAuth bearer tokens on its REST API — it authenticates with a username + API token over HTTP Basic. This connector supports two auth modes, chosen per managed resource at install time via the Authentication field:

• Per-user credential (user_secret, default, recommended) — each user links their own Jenkins username + API token once, through a PolicyArc-hosted browser page reached by MCP URL elicitation on the first call. The credential posts only to the AS (never through the MCP client or the model), is stored encrypted per (subject, resource), and is sent as Authorization: Basic base64(user:token) on that user's calls — so Jenkins attributes every build and action to the real user. If the token later expires, the upstream 401 triggers a re-link prompt.
• Shared service credential (static) — every call uses one operator-held credential from the basic_auth_env secret (value = base64(user:apitoken)), sent verbatim as the HTTP Basic credential. Jenkins attributes all calls to that one account.

Either way, PolicyArc enforces per-user authorization at the gateway via policy before the request reaches Jenkins. See Per-user upstream credentials for how the user_secret collection flow works.

Setup

• base_url — your Jenkins controller URL, e.g. https://jenkins.example.com.
• upstream_auth.type — user_secret (default) or static.
• basic_auth_env — static mode only — a secret whose value is base64(user:apitoken) (e.g. printf %s 'user:APITOKEN' | base64). Hidden when user_secret is selected.

Creating a Jenkins API token

Jenkins → your name (top-right) → Security → API Token → Add new token. In user_secret mode each user does this for themselves on the collection page; in static mode the operator does it once for the shared service account.

Troubleshooting

• 401 from Jenkins — the username / API token is missing, wrong, or revoked. In user_secret mode the gateway re-prompts the user to reconnect; in static mode check the basic_auth_env secret.
• 403 from the gateway — the caller lacks the scope the route requires.
• 403 from Jenkins — the authenticated user lacks permission on that job.

Manifest reference

• ID: identos.jenkins
• Version: 1.0.0
• Resource type: urn:connector:identos:jenkins
• Capabilities: mcp

Supported auth modes

Type	Details
user_secret	—
static	scheme basic; setup fields: basic_auth_env

Setup fields

ID	Label	Default	Secret?	Notes
base_url	Jenkins base URL	—	no	placeholder: https://jenkins.example.com
upstream_auth.type	Authentication	user_secret	no	user_secret (recommended) has each user link their own Jenkins username + API token, so builds are attributed to the real user. static uses one shared API token for everyone.
basic_auth_env	Basic auth credentials	—	yes	Used only for the static method. A secret whose value is base64(user:apitoken) — e.g. `printf %s 'user:APITOKEN'

Scopes

Scope
jenkins:read
jenkins:execute

Routes

Method	Pattern	Scope	Resource template
POST	/{job_path:.*}/build	jenkins:execute	jenkins://jobs/{{job_path}}
GET	/{job_path:.*}/{build_number}/api/json	jenkins:read	jenkins://jobs/{{job_path}}/builds/{{build_number}}
GET	/{job_path:.*}/{build_number}/consoleText	jenkins:read	jenkins://jobs/{{job_path}}/builds/{{build_number}}

MCP tools

Name	Scope	Description
execute_job	jenkins:execute	Trigger a Jenkins job build. job_path is the path segment from /job/... to the job root (no trailing slash).
get_build_status	jenkins:read	Get the JSON status for a specific build of a Jenkins job.
get_build_console	jenkins:read	Get the console text for a specific build of a Jenkins job.