--- title: Integrate with Jenkins slug: kronpam-how-to-guides-180/integrate-with-jenkins description: Enhance Jenkins job security and streamline access to secrets stored in Kron PAM AAPM with the Kron PAM Secret Plugin. Prevent exposure of sensitive information in Jenkins jobs while enjoying the flexibility of Jenkins script projects and global configura docTags: createdAt: 2022-08-17T14:04:43.000Z --- ## Integration Overview The integration relies on four building blocks that work together: - A Kron PAM vault account (for example, a Linux or Windows account) whose secret Jenkins needs to retrieve. - A Kron PAM Application Token, scoped to the Jenkins host address and bound to the vault account, used to authenticate API requests. - The Kron PAM Secret Plugin, installed in Jenkins, which exposes a "Kron PAM Secret Credential" credential type. - A Jenkins credential of that type, configured with the AAPM REST URL and the request payload (including the application token), which is then bound to a job as an environment variable. ## Step-by-Step Guide ### Step 1 – Locate the Target Account in Kron PAM Vault In the Kron PAM console, navigate to Secrets > Vault and locate the account group and account that Jenkins will need to access. In this example, the jenkinstest account under the LinuxBase account group is used. :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/5aF882Pqvxb08zYQCfZzY_figure-01.png" size="100" isUploading="false" position="center" caption="Figure 1 – Kron PAM Vault, LinuxBase account group with the jenkinstest account." width="1910" height="874" darkWidth="1910" darkHeight="874" alt="Figure 1 – Kron PAM Vault, LinuxBase account group with the jenkinstest account." showCaption="true" indent="2"} ### Step 2 – Create an Application Token for Jenkins Application tokens allow external applications, such as Jenkins, to authenticate to Kron PAM AAPM REST endpoints. Navigate to Secrets > Vault > Application Token and create a new token. :::Paragraph{listRestartPolite="1" indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/WnUU6cbxZCuNLLTQydh7G_figure-02.png" size="100" isUploading="false" position="center" caption="Figure 2 – Application Token tab, showing existing tokens (e.g. Jenkins Plugin)." width="1915" height="906" darkWidth="1915" darkHeight="906" alt="Figure 2 – Application Token tab, showing existing tokens (e.g. Jenkins Plugin)." showCaption="true" indent="2"} 1. Enter an Application Name (e.g. Jenkins Plugin). 2. Set the Authentication Type to Kron Application Token. 3. Enter the Application Network Address Range or Hostname of the Jenkins host (e.g. `/32`). This restricts the token to requests originating from that address. 4. Select the Vault Account(s) that Jenkins should be able to retrieve (e.g. jenkinstest@/LinuxBase). 5. Optionally enable Add Event User and select an Event Username for audit purposes, then click Next. :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/CtRnw5_bXGufy_U9n2GDa_figure-03.png" size="100" isUploading="false" position="center" caption="Figure 3 – Edit Token form with application name, address range, and vault account." width="897" height="857" darkWidth="897" darkHeight="857" alt="Figure 3 – Edit Token form with application name, address range, and vault account." showCaption="true" indent="2"} After completing the wizard, Kron PAM generates the application token value. This token must be copied and stored securely — it is required in the next steps and cannot be retrieved again after the dialog is closed. :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/QZo6uhcJ_UYZlRN9OykJi_figure-04.png" size="100" isUploading="false" position="center" caption="Figure 4 – Generated application token (value redacted for security)." width="1063" height="529" darkWidth="1063" darkHeight="529" alt="Figure 4 – Generated application token (value redacted for security)." showCaption="true" indent="2"} :::hint{type="info"} The token value in Figure 4 has been redacted before publishing this document, because it is a live credential. ::: ### Step 3 – Install and Verify the Kron PAM Secret Plugin in Jenkins The Kron PAM Secret Plugin must be installed in Jenkins before the new credential type becomes available. If the plugin is not yet installed, download the KronPAMSecretPlugin.hpi file and upload it manually: 1. Log into Jenkins as an administrator. 2. Navigate to Dashboard > Manage Jenkins > Manage Plugins > Advanced tab. 3. In the Upload Plugin section, browse for KronPAMSecretPlugin.hpi and click Upload. 4. Restart Jenkins after the plugin has been uploaded. :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/3LlT4-Tux-IIgkuBUA8Ti_figure-05.png" size="100" isUploading="false" position="center" caption="Figure 5 – KronPAMSecretPlugin.hpi file as downloaded on the local system." width="800" height="411" darkWidth="800" darkHeight="411" showCaption="true" indent="2"} :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/FsLxmRHL4ZFT6NCYj19XN_figure-06.png" size="100" isUploading="false" position="center" caption="Figure 6 – Uploading the plugin .hpi file via Manage Plugins > Advanced (Kron PAM documentation)." width="1908" height="1029" darkWidth="1908" darkHeight="1029" alt="Figure 6 – Uploading the plugin .hpi file via Manage Plugins > Advanced (Kron PAM documentation)." showCaption="true" indent="2"} :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/7sGWHzI_R2H6MpC_3wAgL_figure-07.png" size="100" isUploading="false" position="center" caption="Figure 7 – Kron PAM Secret Plugin listed and enabled." width="1558" height="74" darkWidth="1558" darkHeight="74" alt="Figure 7 – Kron PAM Secret Plugin listed and enabled." showCaption="true" indent="2"} :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/gN-3AHHi6xY5aE5R_PVSP_figure-08.png" size="100" isUploading="false" position="center" caption="Figure 8 – Installed plugins list, filtered by "Kron PAM", confirming the plugin is active." width="1905" height="440" darkWidth="1905" darkHeight="440" showCaption="true" alt="Figure 8 – Installed plugins list, filtered by "Kron PAM", confirming the plugin is active." indent="2"} ### Step 4 – Add a Kron PAM Secret Credential in Jenkins With the plugin enabled, a new credential type becomes available. Navigate to Dashboard > Manage Jenkins > Credentials > System > Global credentials (unrestricted) > Add Credentials, and select Kron PAM Secret Credential from the list of credential kinds. :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/7sGWHzI_R2H6MpC_3wAgL_figure-07.png" size="100" isUploading="false" position="center" caption="Figure 9 – Add Credentials dialog, with Kron PAM Secret Credential selected." width="1558" height="74" darkWidth="1558" darkHeight="74" alt="Figure 9 – Add Credentials dialog, with Kron PAM Secret Credential selected." showCaption="true" indent="2"} Jenkins then presents the Kron PAM Secret Credential form, to be completed in the next step. :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/anemlQiImxF_cpUlWqdIg_figure-10.png" size="100" isUploading="false" position="center" caption="Figure 10 – Empty Add Kron PAM Secret Credential form (Scope, URL, Data, ID, Description)." width="574" height="697" darkWidth="574" darkHeight="697" alt="Figure 10 – Empty Add Kron PAM Secret Credential form (Scope, URL, Data, ID, Description)." showCaption="true" indent="2"} ### Step 5 – Configure the Credential Data The credential definition tells Jenkins which AAPM REST endpoint to call and what request payload to send, including the application token generated in Step 2. 1. Set Scope to GLOBAL (Jenkins, nodes, items, all child items, etc.). 2. Set URL to the AAPM password request endpoint of your Kron PAM host, for example: `https://[kron-pam-host]/aioc-rest-web/rest/aapm/request/password` 3. In Data, provide a JSON payload identifying the account and request options, including tenantId, comment, passwordChangeRequired, passwordExpirationInMinute and the application token. 4. Set ID to a recognizable name (e.g. AAPM SECRET) - this is the identifier used later when binding the credential to a job. 5. Click Create (or Save, when updating an existing credential). :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Cdbr5F-ShJP8meaxlcW3o_figure-11.png" size="100" isUploading="false" position="center" caption="Figure 11 – Credential Data payload (token value redacted for security)." width="1892" height="1011" darkWidth="1892" darkHeight="1011" showCaption="true" indent="2"} :::hint{type="info"} The token value in Figure 11 has been redacted for the same reason as Figure 4. In the live environment this field contains the full application token generated in Step 2. ::: ### Step 6 – Confirm Credential Usage Opening the credential detail page shows a Usage section, which lists the Jenkins jobs referencing it. This is useful for auditing which pipelines depend on a given Kron PAM secret. :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/2RaOxQKb7YZmqm-qeB617_figure-12.png" size="100" isUploading="false" position="center" caption="Figure 12 – Kron PAM Credential:AAPM SECRET detail page, showing usage in AAPM TEST Project." width="1900" height="381" darkWidth="1900" darkHeight="381" alt="Figure 12 – Kron PAM Credential:AAPM SECRET detail page, showing usage in AAPM TEST Project." showCaption="true" indent="2"} ### Step 7 – Bind the Secret to a Jenkins Job Open the target project (freestyle project in this example) and click Configure. Under the Environment section, enable Use secret text(s) or file(s), then add a binding: 1. Under Bindings, click Add and select Kron PAM Secret Credential. 2. Set the Variable name that the build steps will use to reference the secret (e.g. KRON\_PAM\_SECRET). 3. Under Credentials, choose Specific credentials and select the Kron PAM Credential created in Step 5 (e.g. Kron PAM Credential\:AAPM SECRET). :::hint{type="success"} (Optional) Additional credentials can be bound the same way using the Add button. ::: :::Paragraph{indent="1"} ::: ::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Nd5Pz7IWORNf3m2p3wT1K_figure-13.png" size="100" isUploading="false" position="center" caption="Figure 13 – Job Configure > Environment tab, with the Kron PAM Secret Credential bound to KRON_PAM_SECRET." width="1909" height="758" darkWidth="1909" darkHeight="758" alt="Figure 13 – Job Configure > Environment tab, with the Kron PAM Secret Credential bound to KRON_PAM_SECRET." showCaption="true" indent="2"} ### Step 8 – Use the Secret in a Build Step The bound variable is injected as an environment variable into the build step, so it can be referenced without ever appearing in plain text in the job configuration. In this example, an Execute Windows batch command build step uses the secret to authenticate an SSH session via plink: ```shell plink -ssh -hostkey "ssh-ed25519 255 SHA256:..." jenkinstest@10.20.30.40 -pw %KRON_PAM_SECRET% -batch cat /home/jenkinstest/jenkinsfile ``` ![Figure 14 – Build step referencing the secret via the %KRON\_PAM\_SECRET% environment variable.](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/gRav6KYX7kFbEiWOOh8yz_figure-14.png "Figure 14 – Build step referencing the secret via the %KRON_PAM_SECRET% environment variable.") Save (or Apply) the job configuration once the build step is complete. ### Step 9 – Verify via Kron PAM Audit Logs Every time a Jenkins build runs and retrieves the secret, Kron PAM records the request. Navigate to Secrets > Audit and select the Application Request tab to confirm that the relevant account (e.g. jenkinstest) are logged, with the Event Application Name matching the token. A successful retrieval shows HTTP Status Code 200 with a Response Message of OK; failed attempts (for example, when the Client IP does not match the application token's configured address range) are logged with a non-200 status and an error message, which is useful for troubleshooting. ![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/JDlhJUlq8Dz-7GVVQAeQX_figure16-redacted-2026-08-14.png "Figure 15 – Kron PAM Audit log Application Request tab, showing AAPM password requests from the Jenkins Plugin") ## Result Jenkins is now integrated with Kron PAM AAPM through the Kron PAM Secret Plugin. Jenkins jobs bound to the configured credential can retrieve the target account's secret at build time via an environment variable, without the secret ever being stored in the job configuration, in source control, or in plain text logs. Every retrieval is recorded in the Kron PAM audit trail, providing traceability between Jenkins builds and vault access.