Authenticating TeamCity Builds to External Services With OIDC

Summary

Static CI/CD credentials can leak through logs or artifacts, expose uncertainty over who copies them, and require rotation, so the article presents OIDC as an alternative for authenticating TeamCity builds. It explains the workload flow: an identity provider issues a signed JWT whose claims include validity, audience, and issuer, while the consuming service retrieves metadata and JWKS, verifies the signature, and checks those claims. The TeamCity OIDC JWT plugin makes the server an identity provider, supports RSA- or ECDSA-based signing, key rotation, configurable public issuer hosting, and extensions for HSMs or key-management services. After installation from JetBrains Marketplace, build configurations can issue tokens at startup or on demand, with default or fixed five-minute lifetimes, for direct presentation or token exchange with AWS, Google Cloud, and other OIDC services.

Takeaways

1. 1

   OIDC consumers validate a JWT by retrieving issuer metadata and JWKS, verifying its signature, and checking its audience and validity period.

2. 2

   The startup token feature stores a configurable-lifetime token in a build parameter; the on-demand HTTP feature issues tokens with a fixed five-minute lifetime.

3. 3

   The plugin supports publicly accessible and internet-inaccessible TeamCity instances, including configurable public issuer URLs and extension points for HSMs or services such as Google Cloud KMS.