Check on SAML plugin

[mbarbero]

https://plugins.jenkins.io/saml/
https://support.cloudbees.com/hc/en-us/articles/227202668-SAML-Plugin-Basics

This could replace direct ldap connection. Allows Jenkins setup outside of LAN where LDAP is reachable. Plugin is supported by Cloudbees whereas OPenIDConnect plugin (https://plugins.jenkins.io/oic-auth/) is more or less dead (no update in 2y).

[heurtematte]

oic-auth plugin seems more active since.
Latest version 2.6 was release release 3 month ago. another on january 2023, and 4 releases in 2022.

[mbarbero]

oic-auth plugin seems more active since.
Latest version 2.6 was release release 3 month ago. another on january 2023, and 4 releases in 2022.

By 1 single contributor unfortunately, and 0 public track record that they would handle a security issue properly. Given the criticality of the provided feature, I'd still put my bet on the SAML plugin as it's being maintained by CloudBees (and commercial support probably being sold on it).

[heurtematte]

IMO only one contributor is fine there are so many open-source projects with so few contributors. I preferred look at the repository activity, commits, tags, but also answers in issues which is the case.

In term of security the plugin mainly rely on google-oauth-client, but yes security hole can exist, even in a saml plugin.

I would never bet on SAML, when most companies are trying to get ride of it. It's only a matter of time. 🤞