Configuring OpenID Connect in JFrog

Overview

OpenID Connect (OIDC) allows your GitHub Actions workflows to authenticate with JFrog to download and publish artifacts without storing JFrog passwords, tokens, or API keys in GitHub.

This guide gives an overview of how to configure JFrog to trust GitHub's OIDC as a federated identity, and demonstrates how to use this configuration in a GitHub Actions workflow.

For an example GitHub Actions workflow, see Sample GitHub Actions Integration in the JFrog documentation.

For an example GitHub Actions workflow using the JFrog CLI, see build-publish.yml in the jfrog-github-oidc-example repository.

Prerequisites

• 若要了解 GitHub 如何使用 OpenID Connect (OIDC) 及其体系结构和优势的基本概念，请参阅“关于使用 OpenID Connect 进行安全强化”。

• 在继续之前，必须规划安全策略，以确保仅以可预测的方式分配访问令牌。 要控制云提供商颁发访问令牌的方式，必须至少定义一个条件，以便不受信任的存储库无法为云资源请求访问令牌。 有关详细信息，请参阅“关于使用 OpenID Connect 进行安全强化”。

• To be secure, you need to set a Claims JSON in JFrog when configuring identity mappings. For more information, see AUTOTITLE and 关于使用 OpenID Connect 进行安全强化.

  For example, you can set iss to https://token.actions.githubusercontent.com, and the repository to something like "octo-org/octo-repo"`. This will ensure only Actions workflows from the specified repository will have access to your JFrog platform. The following is an example Claims JSON when configuring identity mappings.

  JSON

  {
      "iss": "https://token.actions.githubusercontent.com",
      "repository": "octo-org/octo-repo"
  }
  

Adding the identity provider to JFrog

To use OIDC with JFrog, establish a trust relationship between GitHub Actions and the JFrog platform. For more information about this process, see OpenID Connect Integration in the JFrog documentation.

1. Sign in to your JFrog Platform.
2. Configure trust between JFrog and your GitHub Actions workflows.
3. Configure identity mappings.

Updating your GitHub Actions workflow

Authenticating with JFrog using OIDC

In your GitHub Actions workflow file, ensure you are using the provider name and audience you configured in the JFrog Platform.

The following example uses the placeholders YOUR_PROVIDER_NAME and YOUR_AUDIENCE.

permissions:
  id-token: write
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Set up JFrog CLI with OIDC
        id: setup-jfrog-cli
        uses: jfrog/setup-jfrog-cli@29fa5190a4123350e81e2a2e8d803b2a27fed15e
        with:
          JF_URL: $
          oidc-provider-name: 'YOUR_PROVIDER_NAME' 
          oidc-audience: 'YOUR_AUDIENCE' # This is optional

      - name: Upload artifact
        run: jf rt upload "dist/*.zip" my-repo/

Using OIDC Credentials in other steps

      - name: Sign in to Artifactory Docker registry
        uses: docker/login-action@v3
        with:
          registry: $
          username: $
          password: $

Further reading

• OpenID Connect Integration in the JFrog documentation
• Identity Mappings in the JFrog documentation
• 关于使用 OpenID Connect 进行安全强化