Authentication methods (LDAP, SAML) in Jenkins - Step-by-Step Execution

Process Flow - Authentication methods (LDAP, SAML)

User tries to login

↓

Select Auth Method

↓

LDAP Auth

↓

Query LDAP

↓

Validate User

↓

Grant Access

↓

Access Jenkins

User login triggers either LDAP or SAML authentication flow, both validate credentials and grant access to Jenkins.

Execution Sample

Jenkins

User logs in -> Choose LDAP or SAML -> Authenticate -> Access Jenkins

Shows the step-by-step flow of user authentication using LDAP or SAML in Jenkins.

Process Table

Step	Action	Method	System Request	System Response	Result
1	User enters credentials	N/A	N/A	N/A	Credentials captured
2	Select authentication method	LDAP	Send LDAP query	LDAP server responds	User info retrieved
3	Validate credentials	LDAP	Check password	Password match	Authentication success
4	Grant access	LDAP	N/A	N/A	User logged in
5	User enters credentials	N/A	N/A	N/A	Credentials captured
6	Select authentication method	SAML	Redirect to SAML IdP	IdP login page	User redirected
7	User authenticates at IdP	SAML	Submit credentials	SAML token issued	Token received
8	Validate SAML token	SAML	Verify token signature	Token valid	Authentication success
9	Grant access	SAML	N/A	N/A	User logged in

💡 Authentication completes when user credentials are validated and access is granted.

Status Tracker

Variable	Start	After LDAP Step 2	After LDAP Step 3	After SAML Step 7	After SAML Step 8	Final
Credentials	None	Captured	Validated	Captured	Validated	Used for login
Auth Method	None	LDAP	LDAP	SAML	SAML	Set per login
User Info	None	Retrieved	Confirmed	None	Received via token	Confirmed
Access Status	No	No	Yes	No	Yes	Yes

Key Moments - 3 Insights

Why does LDAP require querying a server while SAML redirects the user?

LDAP directly queries the directory server to check credentials (see execution_table rows 2-3), while SAML uses a redirect to an external Identity Provider (rows 6-7) for authentication.

What happens if the SAML token is invalid?

If the SAML token fails validation (not shown in table but implied after row 8), access is denied and login fails, unlike LDAP which validates credentials directly.

Why are there two 'User enters credentials' steps?

Because in LDAP, credentials are entered directly in Jenkins (row 1), but in SAML, credentials are entered at the external IdP after redirect (row 7).

Visual Quiz - 3 Questions

Look at the execution table, at which step does LDAP validate the user's password?

A Step 2

B Step 3

C Step 6

D Step 8

💡 Hint

Check the 'Action' and 'Result' columns for LDAP steps in the execution_table.

According to the variable tracker, when does 'Access Status' become 'Yes' for SAML?

A After Step 6

B After Step 7

C After Step 8

D After Step 3

💡 Hint

Look at the 'Access Status' row and the columns for SAML steps in variable_tracker.

If the user chooses LDAP but the LDAP server does not respond, which step would fail?

A Step 2

B Step 3

C Step 6

D Step 7

💡 Hint

Refer to the 'System Request' and 'System Response' columns for LDAP in execution_table.

Concept Snapshot

Authentication methods in Jenkins:
- LDAP: Jenkins queries LDAP server directly to validate credentials.
- SAML: Jenkins redirects user to external Identity Provider (IdP) for login.
- Both methods validate user and grant access.
- LDAP handles credentials internally; SAML uses tokens from IdP.
- Choose method based on your organization's setup.

Full Transcript

This visual execution shows how Jenkins authenticates users using LDAP or SAML. When a user logs in, Jenkins captures credentials and selects the authentication method. For LDAP, Jenkins sends a query to the LDAP server to retrieve user info and validate the password. If successful, access is granted. For SAML, Jenkins redirects the user to an external Identity Provider where the user logs in. The IdP sends back a SAML token, which Jenkins validates before granting access. Variables like credentials, authentication method, user info, and access status change step-by-step during the process. Key points include the difference in where credentials are entered and how validation happens. The quizzes test understanding of these steps and variable changes.