Context & Problem
I'm working on a DevOps platform for a company which wants to provide developers with tools for code versioning & automatic testing / build / deploy, using Gitlab + Jenkins + Azure (alongside other tools like Jira / Sonarqube / Grafana, but not relevant here).
For security reasons & ease of management, we want to provide users with only one account for all those tools : Azure Active Directory.
Currently, Gitlab users can connect through Azure AD, and a push to the Gitlab repository triggers a build in Jenkins. When I configure Jenkins authentication through Azure AD, the Gitlab integration with Jenkins doesn't work anymore, since you can no longer use username / password to connect to Jenkins, and it seems the only way provided by Gitlab integrations.
Current Setup
- Gitlab (14.6.0-ee) & Jenkins (2.319.1) are installed on 2 different virtual machines (CentOs 7.9) hosted on Azure
- Jenkins integration is enabled on Gitlab (https://docs.gitlab.com/ee/integration/jenkins.html)
- Gitlab plugin is enabled on Jenkins (https://plugins.jenkins.io/gitlab-plugin/)
- Jenkins integration with Azure Active Directory works fine (https://plugins.jenkins.io/azure-ad/)
- Groups & Users are configured on Azure AD to give roles on Jenkins (https://www.cloudbees.com/blog/securing-jenkins-role-based-access-control-and-azure-active-directory)
- ā
When Azure AD is not enabled on Jenkins, Gitlab triggers build after each push, and you can track every step status in Gitlab
- ā When Azure AD is enabled on Jenkins, Gitlab cannot trigger Jenkins (using Webhooks or official Jenkins integration)
Questions
- Is there a way for Jenkins to provide multiple auth strategies depending on the user ? (as Gitlab does)
- Is there a way for Gitlab to use something else that user / password for Jenkins integration or Webhooks ?
- Do we have to choose between Azure AD & Gitlab integration ? (if so, does this mean no one uses Jenkins Single Sign On & Gitlab ? Seems weird)
Leads & Ideas
- Tried using webhooks instead of the Jenkins integration, but it fails since the webhooks also need username / password (and integration would probably be less "advanced")
- Tried finding a way to enable multiple auth methods on Jenkins, but seems impossible right now (https://issues.jenkins.io/browse/JENKINS-15063)
- Tried giving role permissions to Gitlab on Azure AD, but it won't change anything since I can't find how to make Gitlab using OAuth with Jenkins
I searched thorougly for answers, but still may have missed something trivial. I didn't find much litterature on this specific setup, so I'm hoping someone around here did encounter this type of situation before
Thank you for your help