From 30d69640c37e87f82fa32b912bf627f154f3a662 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Fri, 7 Aug 2026 11:17:26 +0000 Subject: [PATCH 1/9] docs(registry/coder/modules/jfrog-oauth): clarify JFrog SaaS and self-hosted OAuth setup --- registry/coder/modules/jfrog-oauth/README.md | 32 ++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index 5e53fa047..bbfa77ffe 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -8,7 +8,7 @@ tags: [integration, jfrog, helper] # JFrog -Install the JF CLI and authenticate package managers with Artifactory using OAuth configured via the Coder [`external-auth`](https://coder.com/docs/v2/latest/admin/external-auth) feature. +Install the JF CLI and authenticate package managers with Artifactory using OAuth configured via the Coder [`external-auth`](https://coder.com/docs/admin/external-auth) feature. ![JFrog OAuth](../../.images/jfrog-oauth.png) @@ -38,7 +38,35 @@ module "jfrog" { ## Prerequisites -This module is usable by JFrog self-hosted (on-premises) Artifactory as it requires configuring a custom integration. This integration benefits from Coder's [external-auth](https://coder.com/docs/v2/latest/admin/external-auth) feature and allows each user to authenticate with Artifactory using an OAuth flow and issues user-scoped tokens to each user. For configuration instructions, see this [guide](https://coder.com/docs/v2/latest/guides/artifactory-integration#jfrog-oauth) on the Coder documentation. +This module works with both JFrog SaaS (for example, `example.jfrog.io`) and self-hosted (on-premises) Artifactory. It uses Coder's [external-auth](https://coder.com/docs/admin/external-auth) feature so each user authenticates with Artifactory through an OAuth flow, and Coder issues a user-scoped access token to each workspace. + +Using the module requires two things: an application integration in Artifactory and a matching external authentication provider in Coder. The full walkthrough, including the Helm values for self-hosted instances, lives in the [JFrog Artifactory integration guide](https://coder.com/docs/admin/integrations/jfrog-artifactory#jfrog-oauth). The steps below summarize the setup. + +## Setup + +1. Create an application integration in Artifactory: + - **JFrog SaaS** (`example.jfrog.io`): Go to `https://JFROG_URL/ui/admin/configuration/integrations/app-integrations/new` and select **Custom Integration** as the application type. + - **Self-hosted (on-premises)**: First register an integration template in your Helm `values.yaml` (see the [integration guide](https://coder.com/docs/admin/integrations/jfrog-artifactory#jfrog-oauth)), then create the application integration and select that template as the application type. + + Set the redirect URI to `https://CODER_URL/external-auth/jfrog/callback` and the scope to `applied-permissions/user`. Save the generated **Client ID** and **Client Secret**. + +2. Add a JFrog [external authentication](https://coder.com/docs/admin/external-auth) provider to your Coder deployment. Replace `JFROG_URL` and the client ID and secret with the values from step 1: + + ```dotenv + # JFrog Artifactory External Auth + CODER_EXTERNAL_AUTH_1_ID="jfrog" + CODER_EXTERNAL_AUTH_1_TYPE="jfrog" + CODER_EXTERNAL_AUTH_1_CLIENT_ID="YYYYYYYYYYYYYYY" + CODER_EXTERNAL_AUTH_1_CLIENT_SECRET="XXXXXXXXXXXXXXXXXXX" + CODER_EXTERNAL_AUTH_1_DISPLAY_NAME="JFrog Artifactory" + CODER_EXTERNAL_AUTH_1_DISPLAY_ICON="/icon/jfrog.svg" + CODER_EXTERNAL_AUTH_1_AUTH_URL="https://JFROG_URL/ui/authorization" + CODER_EXTERNAL_AUTH_1_SCOPES="applied-permissions/user" + ``` + + The `external_auth_id` module input defaults to `jfrog` and must match `CODER_EXTERNAL_AUTH_1_ID`. + +3. Add this module to your template (see the example above). When a user creates a workspace, Coder prompts them to authenticate with Artifactory and injects a user-scoped token. ## Username Handling From 360c82bc007bc1946be7e6faa61f68ad61650264 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Fri, 7 Aug 2026 11:18:53 +0000 Subject: [PATCH 2/9] docs(registry/coder/modules/jfrog-oauth): describe SaaS OAuth app UI flow --- registry/coder/modules/jfrog-oauth/README.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index bbfa77ffe..0abc058fd 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -44,11 +44,11 @@ Using the module requires two things: an application integration in Artifactory ## Setup -1. Create an application integration in Artifactory: - - **JFrog SaaS** (`example.jfrog.io`): Go to `https://JFROG_URL/ui/admin/configuration/integrations/app-integrations/new` and select **Custom Integration** as the application type. - - **Self-hosted (on-premises)**: First register an integration template in your Helm `values.yaml` (see the [integration guide](https://coder.com/docs/admin/integrations/jfrog-artifactory#jfrog-oauth)), then create the application integration and select that template as the application type. +1. Create an application integration in Artifactory. Use `https://CODER_URL/external-auth/jfrog/callback` (your Coder deployment URL) as the callback/redirect URI and `applied-permissions/user` as the scope. + - **JFrog SaaS** (`example.jfrog.io`): In the JFrog Platform UI, go to **Administration > General Management > Manage Integrations**, click **New Integration**, and select **Application**. Give it a name, choose the custom integration option, enter the callback URL above, then click **Generate Client ID & Secret**. + - **Self-hosted (on-premises)**: First register an integration template in your Helm `values.yaml` (see the [integration guide](https://coder.com/docs/admin/integrations/jfrog-artifactory#jfrog-oauth)), then create the application integration in the UI and select that template as the application type. - Set the redirect URI to `https://CODER_URL/external-auth/jfrog/callback` and the scope to `applied-permissions/user`. Save the generated **Client ID** and **Client Secret**. + Save the generated **Client ID** and **Client Secret** for the next step. 2. Add a JFrog [external authentication](https://coder.com/docs/admin/external-auth) provider to your Coder deployment. Replace `JFROG_URL` and the client ID and secret with the values from step 1: From a21d165b94d796bec6068c6f0308b7315c22c457 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Mon, 10 Aug 2026 18:48:28 +0000 Subject: [PATCH 3/9] docs(registry/coder/modules/jfrog-oauth): use exact SaaS External Applications UI path --- registry/coder/modules/jfrog-oauth/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index 0abc058fd..3e1b07870 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -45,7 +45,7 @@ Using the module requires two things: an application integration in Artifactory ## Setup 1. Create an application integration in Artifactory. Use `https://CODER_URL/external-auth/jfrog/callback` (your Coder deployment URL) as the callback/redirect URI and `applied-permissions/user` as the scope. - - **JFrog SaaS** (`example.jfrog.io`): In the JFrog Platform UI, go to **Administration > General Management > Manage Integrations**, click **New Integration**, and select **Application**. Give it a name, choose the custom integration option, enter the callback URL above, then click **Generate Client ID & Secret**. + - **JFrog SaaS** (`example.jfrog.io`): In the JFrog Platform UI, go to **Administration > General Management > Manage Integrations**, click **New Integration**, and select **External Applications** (or open `https://JFROG_URL/ui/admin/configuration/integrations/application` directly). On the **Create New Application Integration** form, set **Application Name** to `Coder`, set **Application Type** to **Custom Integration**, enter the callback URL above, then click **Generate Client ID & Secret**. - **Self-hosted (on-premises)**: First register an integration template in your Helm `values.yaml` (see the [integration guide](https://coder.com/docs/admin/integrations/jfrog-artifactory#jfrog-oauth)), then create the application integration in the UI and select that template as the application type. Save the generated **Client ID** and **Client Secret** for the next step. From 19a28b3c5a9fa89f240bfbd8d4ee45ab2cf86698 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Mon, 10 Aug 2026 20:32:09 +0000 Subject: [PATCH 4/9] chore(registry/coder/modules/jfrog-oauth): bump version to 1.2.5 --- registry/coder/modules/jfrog-oauth/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index 3e1b07870..0fd00c268 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -16,7 +16,7 @@ Install the JF CLI and authenticate package managers with Artifactory using OAut module "jfrog" { count = data.coder_workspace.me.start_count source = "registry.coder.com/coder/jfrog-oauth/coder" - version = "1.2.4" + version = "1.2.5" agent_id = coder_agent.main.id jfrog_url = "https://example.jfrog.io" username_field = "username" # If you are using GitHub to login to both Coder and Artifactory, use username_field = "username" @@ -85,7 +85,7 @@ Configure the Python pip package manager to fetch packages from Artifactory whil module "jfrog" { count = data.coder_workspace.me.start_count source = "registry.coder.com/coder/jfrog-oauth/coder" - version = "1.2.4" + version = "1.2.5" agent_id = coder_agent.main.id jfrog_url = "https://example.jfrog.io" username_field = "email" @@ -115,7 +115,7 @@ The [JFrog extension](https://open-vsx.org/extension/JFrog/jfrog-vscode-extensio module "jfrog" { count = data.coder_workspace.me.start_count source = "registry.coder.com/coder/jfrog-oauth/coder" - version = "1.2.3" + version = "1.2.5" agent_id = coder_agent.main.id jfrog_url = "https://example.jfrog.io" username_field = "username" # If you are using GitHub to login to both Coder and Artifactory, use username_field = "username" From d48fde35e29c31851b3d1388625562bbc676802a Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Mon, 10 Aug 2026 21:01:37 +0000 Subject: [PATCH 5/9] docs(registry/coder/modules/jfrog-oauth): add offline use, endpoints, and value framing --- registry/coder/modules/jfrog-oauth/README.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index 0fd00c268..1b1f7dc39 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -8,7 +8,9 @@ tags: [integration, jfrog, helper] # JFrog -Install the JF CLI and authenticate package managers with Artifactory using OAuth configured via the Coder [`external-auth`](https://coder.com/docs/admin/external-auth) feature. +Install the JFrog CLI and authenticate package managers with Artifactory using OAuth configured via the Coder [`external-auth`](https://coder.com/docs/admin/external-auth) feature. + +On top of Coder's OAuth external-auth, this module installs the JFrog CLI (`jf`) and configures your package managers (npm, Go, pip, Docker, Conda, and Maven) to resolve from Artifactory using each user's own OAuth token. No API keys or passwords are stored in the template or the workspace, and tokens are scoped to the individual user. ![JFrog OAuth](../../.images/jfrog-oauth.png) @@ -68,6 +70,19 @@ Using the module requires two things: an application integration in Artifactory 3. Add this module to your template (see the example above). When a user creates a workspace, Coder prompts them to authenticate with Artifactory and injects a user-scoped token. +## JFrog CLI installation and offline use + +The module installs the JFrog CLI (`jf`) when the workspace starts. If `jf` is already on the `PATH` (for example, baked into your workspace image), the module detects it and skips the download, so no external download is attempted. + +When the CLI is not present, the startup script downloads it from `https://install-cli.jfrog.io` and installs it with `sudo`. In restricted or air-gapped environments, pre-install `jf` in your workspace image to avoid both the external download and the `sudo` step. + +### External endpoints + +The module's startup script contacts: + +- `https://install-cli.jfrog.io`: only when the JFrog CLI is not already installed. +- Your `jfrog_url` (for example, `https://example.jfrog.io`): to configure the package managers and exchange the OAuth token. + ## Username Handling The module automatically extracts your JFrog username directly from the OAuth token's JWT payload. This preserves special characters like dots (`.`), hyphens (`-`), and accented characters that Coder normalizes in usernames. From 05b3b5eff6c6eb1c03fc5d50ab987cae9f388973 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Mon, 10 Aug 2026 21:16:31 +0000 Subject: [PATCH 6/9] docs(registry/coder/modules/jfrog-oauth): remove duplicated OAuth framing in intro --- registry/coder/modules/jfrog-oauth/README.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index 1b1f7dc39..a7d1dcd75 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -8,9 +8,7 @@ tags: [integration, jfrog, helper] # JFrog -Install the JFrog CLI and authenticate package managers with Artifactory using OAuth configured via the Coder [`external-auth`](https://coder.com/docs/admin/external-auth) feature. - -On top of Coder's OAuth external-auth, this module installs the JFrog CLI (`jf`) and configures your package managers (npm, Go, pip, Docker, Conda, and Maven) to resolve from Artifactory using each user's own OAuth token. No API keys or passwords are stored in the template or the workspace, and tokens are scoped to the individual user. +Install the JFrog CLI (`jf`) and authenticate package managers (npm, Go, pip, Docker, Conda, and Maven) with Artifactory using OAuth, configured via the Coder [`external-auth`](https://coder.com/docs/admin/external-auth) feature. Each user authenticates through an OAuth flow and receives a user-scoped access token, so no API keys or passwords are stored in the template or the workspace. ![JFrog OAuth](../../.images/jfrog-oauth.png) @@ -40,7 +38,7 @@ module "jfrog" { ## Prerequisites -This module works with both JFrog SaaS (for example, `example.jfrog.io`) and self-hosted (on-premises) Artifactory. It uses Coder's [external-auth](https://coder.com/docs/admin/external-auth) feature so each user authenticates with Artifactory through an OAuth flow, and Coder issues a user-scoped access token to each workspace. +This module works with both JFrog SaaS (for example, `example.jfrog.io`) and self-hosted (on-premises) Artifactory. Using the module requires two things: an application integration in Artifactory and a matching external authentication provider in Coder. The full walkthrough, including the Helm values for self-hosted instances, lives in the [JFrog Artifactory integration guide](https://coder.com/docs/admin/integrations/jfrog-artifactory#jfrog-oauth). The steps below summarize the setup. From abc68ca31963419dd373804066b6b756eeef6016 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Mon, 10 Aug 2026 21:18:25 +0000 Subject: [PATCH 7/9] docs(registry/coder/modules/jfrog-oauth): align description with JFrog CLI naming --- registry/coder/modules/jfrog-oauth/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index a7d1dcd75..931f4365c 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -1,6 +1,6 @@ --- display_name: JFrog (OAuth) -description: Install the JF CLI and authenticate with Artifactory using OAuth. +description: Install the JFrog CLI and authenticate with Artifactory using OAuth. icon: ../../../../.icons/jfrog.svg verified: true tags: [integration, jfrog, helper] From e9567d1e23c9ce1ff4ea38b2055a89ca61d90815 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Mon, 10 Aug 2026 21:45:08 +0000 Subject: [PATCH 8/9] docs(registry/coder/modules/jfrog-oauth): drop repeated CLI install sentence --- registry/coder/modules/jfrog-oauth/README.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index 931f4365c..3e829ad92 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -70,9 +70,7 @@ Using the module requires two things: an application integration in Artifactory ## JFrog CLI installation and offline use -The module installs the JFrog CLI (`jf`) when the workspace starts. If `jf` is already on the `PATH` (for example, baked into your workspace image), the module detects it and skips the download, so no external download is attempted. - -When the CLI is not present, the startup script downloads it from `https://install-cli.jfrog.io` and installs it with `sudo`. In restricted or air-gapped environments, pre-install `jf` in your workspace image to avoid both the external download and the `sudo` step. +If `jf` is already on the `PATH` (for example, baked into your workspace image), the module detects it and skips the download. Otherwise, the startup script downloads it from `https://install-cli.jfrog.io` and installs it with `sudo`. In restricted or air-gapped environments, pre-install `jf` in your workspace image to avoid both the external download and the `sudo` step. ### External endpoints From 8814bbb7344abf0b39bbb1828ef8db2cf0f5f0e6 Mon Sep 17 00:00:00 2001 From: Atif Ali Date: Mon, 10 Aug 2026 21:51:07 +0000 Subject: [PATCH 9/9] docs(registry/coder/modules/jfrog-oauth): rename section to offline and air-gapped --- registry/coder/modules/jfrog-oauth/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/registry/coder/modules/jfrog-oauth/README.md b/registry/coder/modules/jfrog-oauth/README.md index 3e829ad92..49668545e 100644 --- a/registry/coder/modules/jfrog-oauth/README.md +++ b/registry/coder/modules/jfrog-oauth/README.md @@ -68,7 +68,7 @@ Using the module requires two things: an application integration in Artifactory 3. Add this module to your template (see the example above). When a user creates a workspace, Coder prompts them to authenticate with Artifactory and injects a user-scoped token. -## JFrog CLI installation and offline use +## Offline and air-gapped environments If `jf` is already on the `PATH` (for example, baked into your workspace image), the module detects it and skips the download. Otherwise, the startup script downloads it from `https://install-cli.jfrog.io` and installs it with `sudo`. In restricted or air-gapped environments, pre-install `jf` in your workspace image to avoid both the external download and the `sudo` step.