1"use strict";(self.webpackChunktwingate_homepage=self.webpackChunktwingate_homepage||[]).push([[1560],{91560:function(e,t,n){n.r(t),n.d(t,{Head:function(){return T},default:function(){return I}});var l=n(96540),a=n(28453);function r(e){const t=Object.assign({p:"p",a:"a",h1:"h1",span:"span",ol:"ol",li:"li",code:"code",strong:"strong",ul:"ul",pre:"pre",table:"table",thead:"thead",tr:"tr",th:"th",tbody:"tbody",td:"td"},(0,a.RP)(),e.components),{Callout:n}=t;return n||function(e,t){throw new Error("Expected "+(t?"component":"object")+" `"+e+"` to be defined: you likely forgot to import, pass, or provide it.")}("Callout",!0),l.createElement(l.Fragment,null,l.createElement(t.p,null,"Jenkins can authenticate users from headers set by an upstream proxy using the Reverse Proxy Auth plugin, and it can map the Groups in those headers to permissions using the Role-Based Strategy plugin. Together they let Twingate Identity Firewall drive both authentication and authorization in Jenkins with no code changes. You only add three plugins and a configuration file."),"\n",l.createElement(t.p,null,"For the architecture and the full list of headers the Gateway can inject, see the ",l.createElement(t.a,{href:"/docs-assets/5f397c1/docs/web-app-access"},"Identity Firewall for Web Apps overview"),". For the shared security model behind trusted-header integrations, see ",l.createElement(t.a,{href:"/docs-assets/5f397c1/docs/web-app-integrations#security-model"},"Web App Integrations"),"."),"\n",l.createElement(t.h1,{id:"prerequisites",style:{position:"relative"}},l.createElement(t.a,{href:"#prerequisites","aria-label":"prerequisites permalink",className:"remark-autolink-anchor before"},l.createElement(t.span,{dangerouslySetInnerHTML:{__html:'<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M13.3771 7.86873C14.1377 7.10819 15.3708 7.10819 16.1313 7.86873C16.8918 8.62927 16.8918 9.86235 16.1313 10.6229L14.2952 12.459C14.0417 12.7125 14.0417 13.1235 14.2952 13.3771C14.5487 13.6306 14.9597 13.6306 15.2132 13.3771L17.0493 11.5409C18.3169 10.2734 18.3169 8.21824 17.0493 6.95068C15.7818 5.68311 13.7266 5.68311 12.4591 6.95068L10.623 8.78678C10.3695 9.0403 10.3695 9.45132 10.623 9.70484C10.8765 9.95835 11.2875 9.95835 11.541 9.70484L13.3771 7.86873Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.1639 13.8361C9.9104 13.5826 9.9104 13.1716 10.1639 12.9181L12.9181 10.1639C13.1716 9.9104 13.5826 9.9104 13.8361 10.1639C14.0896 10.4174 14.0896 10.8285 13.8361 11.082L11.082 13.8361C10.8285 14.0896 10.4174 14.0896 10.1639 13.8361Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M7.86873 13.3771C7.10819 14.1377 7.10819 15.3707 7.86873 16.1313C8.62927 16.8918 9.86235 16.8918 10.6229 16.1313L12.459 14.2952C12.7125 14.0417 13.1235 14.0417 13.3771 14.2952C13.6306 14.5487 13.6306 14.9597 13.3771 15.2132L11.5409 17.0493C10.2734 18.3169 8.21824 18.3169 6.95068 17.0493C5.68311 15.7818 5.68311 13.7266 6.95068 12.4591L8.78678 10.623C9.0403 10.3694 9.45132 10.3694 9.70484 10.623C9.95835 10.8765 9.95835 11.2875 9.70484 11.541L7.86873 13.3771Z" fill="#A1A1AA"/></svg>'}})),"Prerequisites"),"\n",l.createElement(t.ol,null,"\n",l.createElement(t.li,null,"A Jenkins instance you administer (this guide was verified against ",l.createElement(t.code,null,"jenkins/jenkins:lts-jdk17"),")."),"\n",l.createElement(t.li,null,"Administrator access to install plugins and apply configuration."),"\n",l.createElement(t.li,null,"A Twingate ",l.createElement(t.a,{href:"/docs-assets/5f397c1/docs/web-app-access"},"Web App Resource")," for Jenkins, network-isolated so the Gateway is the only path to it."),"\n"),"\n",l.createElement(t.h1,{id:"install-plugins",style:{position:"relative"}},l.createElement(t.a,{href:"#install-plugins","aria-label":"install plugins permalink",className:"remark-autolink-anchor before"},l.createElement(t.span,{dangerouslySetInnerHTML:{__html:'<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M13.3771 7.86873C14.1377 7.10819 15.3708 7.10819 16.1313 7.86873C16.8918 8.62927 16.8918 9.86235 16.
11313 10.6229L14.2952 12.459C14.0417 12.7125 14.0417 13.1235 14.2952 13.3771C14.5487 13.6306 14.9597 13.6306 15.2132 13.3771L17.0493 11.5409C18.3169 10.2734 18.3169 8.21824 17.0493 6.95068C15.7818 5.68311 13.7266 5.68311 12.4591 6.95068L10.623 8.78678C10.3695 9.0403 10.3695 9.45132 10.623 9.70484C10.8765 9.95835 11.2875 9.95835 11.541 9.70484L13.3771 7.86873Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.1639 13.8361C9.9104 13.5826 9.9104 13.1716 10.1639 12.9181L12.9181 10.1639C13.1716 9.9104 13.5826 9.9104 13.8361 10.1639C14.0896 10.4174 14.0896 10.8285 13.8361 11.082L11.082 13.8361C10.8285 14.0896 10.4174 14.0896 10.1639 13.8361Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M7.86873 13.3771C7.10819 14.1377 7.10819 15.3707 7.86873 16.1313C8.62927 16.8918 9.86235 16.8918 10.6229 16.1313L12.459 14.2952C12.7125 14.0417 13.1235 14.0417 13.3771 14.2952C13.6306 14.5487 13.6306 14.9597 13.3771 15.2132L11.5409 17.0493C10.2734 18.3169 8.21824 18.3169 6.95068 17.0493C5.68311 15.7818 5.68311 13.7266 6.95068 12.4591L8.78678 10.623C9.0403 10.3694 9.45132 10.3694 9.70484 10.623C9.95835 10.8765 9.95835 11.2875 9.70484 11.541L7.86873 13.3771Z" fill="#A1A1AA"/></svg>'}})),"Install Plugins"),"\n",l.createElement(t.p,null,"Install these three plugins from ",l.createElement(t.strong,null,"Manage Jenkins â Plugins"),", or bake them into your image:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.code,null,"configuration-as-code")," applies the security and authorization config below declaratively."),"\n",l.createElement(t.li,null,l.createElement(t.code,null,"reverse-proxy-auth-plugin")," provides the trusted-header security realm that reads the user and Groups."),"\n",l.createElement(t.li,null,l.createElement(t.code,null,"role-strategy")," maps Groups to named roles and permissions."),"\n"),"\n",l.createElement(n,{title:"Use the correct plugin ID",severity:"warn"},l.createElement(t.p,null,"The trusted-header pluginâs artifact ID is ",l.createElement(t.code,null,"reverse-proxy-auth-plugin"),", not ",l.createElement(t.code,null,"reverse-proxy-auth"),". The shorter name returns a 404 in the update center.")),"\n",l.createElement(t.h1,{id:"configure-jenkins-jcasc",style:{position:"relative"}},l.createElement(t.a,{href:"#configure-jenkins-jcasc","aria-label":"configure jenkins jcasc permalink",className:"remark-autolink-anchor before"},l.createElement(t.span,{dangerouslySetInnerHTML:{__html:'<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M13.3771 7.86873C14.1377 7.10819 15.3708 7.10819 16.1313 7.86873C16.8918 8.62927 16.8918 9.86235 16.1313 10.6229L14.2952 12.459C14.0417 12.7125 14.0417 13.1235 14.2952 13.3771C14.5487 13.6306 14.9597 13.6306 15.2132 13.3771L17.0493 11.5409C18.3169 10.2734 18.3169 8.21824 17.0493 6.95068C15.7818 5.68311 13.7266 5.68311 12.4591 6.95068L10.623 8.78678C10.3695 9.0403 10.3695 9.45132 10.623 9.70484C10.8765 9.95835 11.2875 9.95835 11.541 9.70484L13.3771 7.86873Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.1639 13.8361C9.9104 13.5826 9.9104 13.1716 10.1639 12.9181L12.9181 10.1639C13.1716 9.9104 13.5826 9.9104 13.8361 10.1639C14.0896 10.4174 14.0896 10.8285 13.8361 11.082L11.082 13.8361C10.8285 14.0896 10.4174 14.0896 10.1639 13.8361Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M7.86873 13.3771C7.10819 14.1377 7.10819 15.3707 7.86873 16.1313C8.62927 16.8918 9.86235 16.8918 10.6229 16.1313L12.459 14.2952C12.7125 14.0417 13.1235 14.0417 13.3771 14.2952C13.6306 14.5487 13.6306 14.9597 13.3771 15.2132L11.5409 17.0493C10.2734 18.3169 8.21824 18.3169 6.95068 17.0493C5.68311 15.7818 5.68311 13.7266 6.95068 12.4591L8.78678 10.623C9.0403 10.3694 9.45132 10.3694 9.70484 10.623C9.95835 10.8765 9.95835 11.2875 9.70484 11.541L7.86873 13.3771Z" fill="#A1A1AA"/></svg>'}})),"Configure Jenkins (JCasC)"),"\n",l.createElement(t.p,null,"Apply the following ",l.createElement(t.a,{href:"https://www.jenkins.io/projects/jcasc/"},"Configuration as Code")," file. It declares the security realm (authentication) and the authorization strategy in one place:"),"\n",l.createElement(t.pre,null,l.createElement(t.code,{className:"language-yaml"},'jenkins:\n securityRealm:\n reverseProxy:\n forwardedUser: "X-Forwarded-User"\n headerGroups: "X-Forwarded-Groups"\n headerGroupsDelimiter: ","\n disableLdapEmailResolver: true\n\n authorizationStrategy:\n roleBased:\n roles:\n global:\n - name: "admin"\n description: "Full administrative access (mapped from the \'jenkins-admin\' group)."\n permissions:\n - "Overall/Administer"\n entr
1ies:\n - group: "jenkins-admin"\n - name: "viewer"\n description: "Read-only access (mapped from the \'jenkins-viewer\' group)."\n permissions:\n - "Overall/Read"\n - "Job/Read"\n - "View/Read"\n entries:\n - group: "jenkins-viewer"\n')),"\n",l.createElement(t.p,null,"A few field names matter here:"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.code,null,"forwardedUser")," is the header Jenkins reads the username from. Users provision on first request, so you donât pre-create accounts."),"\n",l.createElement(t.li,null,l.createElement(t.code,null,"headerGroups")," is the header carrying the Group list. Use ",l.createElement(t.code,null,"headerGroups"),", not ",l.createElement(t.code,null,"forwardedGroups"),". The ",l.createElement(t.code,null,"forwarded*")," attributes are for display name and email."),"\n",l.createElement(t.li,null,l.createElement(t.code,null,"entries")," is how Role Strategy assigns a Group to a role. The older ",l.createElement(t.code,null,"assignments")," form is rejected as deprecated."),"\n"),"\n",l.createElement(t.h1,{id:"configure-the-twingate-gateway",style:{position:"relative"}},l.createElement(t.a,{href:"#configure-the-twingate-gateway","aria-label":"configure the twingate gateway permalink",className:"remark-autolink-anchor before"},l.createElement(t.span,{dangerouslySetInnerHTML:{__html:'<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M13.3771 7.86873C14.1377 7.10819 15.3708 7.10819 16.1313 7.86873C16.8918 8.62927 16.8918 9.86235 16.1313 10.6229L14.2952 12.459C14.0417 12.7125 14.0417 13.1235 14.2952 13.3771C14.5487 13.6306 14.9597 13.6306 15.2132 13.3771L17.0493 11.5409C18.3169 10.2734 18.3169 8.21824 17.0493 6.95068C15.7818 5.68311 13.7266 5.68311 12.4591 6.95068L10.623 8.78678C10.3695 9.0403 10.3695 9.45132 10.623 9.70484C10.8765 9.95835 11.2875 9.95835 11.541 9.70484L13.3771 7.86873Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.1639 13.8361C9.9104 13.5826 9.9104 13.1716 10.1639 12.9181L12.9181 10.1639C13.1716 9.9104 13.5826 9.9104 13.8361 10.1639C14.0896 10.4174 14.0896 10.8285 13.8361 11.082L11.082 13.8361C10.8285 14.0896 10.4174 14.0896 10.1639 13.8361Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M7.86873 13.3771C7.10819 14.1377 7.10819 15.3707 7.86873 16.1313C8.62927 16.8918 9.86235 16.8918 10.6229 16.1313L12.459 14.2952C12.7125 14.0417 13.1235 14.0417 13.3771 14.2952C13.6306 14.5487 13.6306 14.9597 13.3771 15.2132L11.5409 17.0493C10.2734 18.3169 8.21824 18.3169 6.95068 17.0493C5.68311 15.7818 5.68311 13.7266 6.95068 12.4591L8.78678 10.623C9.0403 10.3694 9.45132 10.3694 9.70484 10.623C9.95835 10.8765 9.95835 11.2875 9.70484 11.541L7.86873 13.3771Z" fill="#A1A1AA"/></svg>'}})),"Configure the Twingate Gateway"),"\n",l.createElement(t.p,null,"On the Jenkins Web App Resource, add ",l.createElement(t.a,{href:"/docs-assets/5f397c1/docs/web-app-access#request-headers"},"request headers")," so the Gateway injects the identity and the userâs Groups on every request:"),"\n",l.createElement(t.table,null,l.createElement(t.thead,null,l.createElement(t.tr,null,l.createElement(t.th,{align:"left"},"Header Key"),l.createElement(t.th,{align:"left"},"Value Template"))),l.createElement(t.tbody,null,l.createElement(t.tr,null,l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"X-Forwarded-User")),l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"{{username}}"))),l.createElement(t.tr,null,l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"X-Forwarded-Groups")),l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"{{groups}}"))))),"\n",l.createElement(n,{title:"Match the Groups delimiter",severity:"warn"},l.createElement(t.p,null,"The Gateway joins ",l.createElement(t.code,null,"{{groups}}")," with commas, so set ",l.createElement(t.code,null,'headerGroupsDelimiter: ","')," in the JCasC file. The pluginâs default is ",l.createElement(t.code,null,"|"),", which would read the entire comma-separated list as one Group name.")),"\n",l.createElement(t.h1,{id:"map-groups-to-roles",style:{position:"relative"}}
1,l.createElement(t.a,{href:"#map-groups-to-roles","aria-label":"map groups to roles permalink",className:"remark-autolink-anchor before"},l.createElement(t.span,{dangerouslySetInnerHTML:{__html:'<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M13.3771 7.86873C14.1377 7.10819 15.3708 7.10819 16.1313 7.86873C16.8918 8.62927 16.8918 9.86235 16.1313 10.6229L14.2952 12.459C14.0417 12.7125 14.0417 13.1235 14.2952 13.3771C14.5487 13.6306 14.9597 13.6306 15.2132 13.3771L17.0493 11.5409C18.3169 10.2734 18.3169 8.21824 17.0493 6.95068C15.7818 5.68311 13.7266 5.68311 12.4591 6.95068L10.623 8.78678C10.3695 9.0403 10.3695 9.45132 10.623 9.70484C10.8765 9.95835 11.2875 9.95835 11.541 9.70484L13.3771 7.86873Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.1639 13.8361C9.9104 13.5826 9.9104 13.1716 10.1639 12.9181L12.9181 10.1639C13.1716 9.9104 13.5826 9.9104 13.8361 10.1639C14.0896 10.4174 14.0896 10.8285 13.8361 11.082L11.082 13.8361C10.8285 14.0896 10.4174 14.0896 10.1639 13.8361Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M7.86873 13.3771C7.10819 14.1377 7.10819 15.3707 7.86873 16.1313C8.62927 16.8918 9.86235 16.8918 10.6229 16.1313L12.459 14.2952C12.7125 14.0417 13.1235 14.0417 13.3771 14.2952C13.6306 14.5487 13.6306 14.9597 13.3771 15.2132L11.5409 17.0493C10.2734 18.3169 8.21824 18.3169 6.95068 17.0493C5.68311 15.7818 5.68311 13.7266 6.95068 12.4591L8.78678 10.623C9.0403 10.3694 9.45132 10.3694 9.70484 10.623C9.95835 10.8765 9.95835 11.2875 9.70484 11.541L7.86873 13.3771Z" fill="#A1A1AA"/></svg>'}})),"Map Groups to Roles"),"\n",l.createElement(t.p,null,"The ",l.createElement(t.code,null,"entries")," in the JCasC file connect a Twingate Group name to a Jenkins role:"),"\n",l.createElement(t.table,null,l.createElement(t.thead,null,l.createElement(t.tr,null,l.createElement(t.th,{align:"left"},"Twingate Group"),l.createElement(t.th,{align:"left"},"Jenkins Role"),l.createElement(t.th,{align:"left"},"Permissions"))),l.createElement(t.tbody,null,l.createElement(t.tr,null,l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"jenkins-admin")),l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"admin")),l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"Overall/Administer")," (full admin)")),l.createElement(t.tr,null,l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"jenkins-viewer")),l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"viewer")),l.createElement(t.td,{align:"left"},l.createElement(t.code,null,"Overall/Read"),", ",l.createElement(t.code,null,"Job/Read"),", ",l.createElement(t.code,null,"View/Read")," (read-only)")))),"\n",l.createElement(t.p,null,"Name your Twingate Groups to match the ",l.createElement(t.code,null,"entries")," values (",l.createElement(t.code,null,"jenkins-admin"),", ",l.createElement(t.code,null,"jenkins-viewer"),"), or edit the JCasC file to match your existing Group names. Naming them for the app they authorize keeps them clear in your identity provider and avoids clashing with the Group names the Gateway always sends (see the note below). To add a tier, add another role block with its own permissions and ",l.createElement(t.code,null,"entries"),"."),"\n",l.createElement(n,{severity:"info"},l.createElement(t.p,null,l.createElement(t.code,null,"{{groups}}")," always includes the built-in ",l.createElement(t.code,null,"twingate:authenticated")," group (and ",l.createElement(t.code,null,"Everyone"),") alongside the Groups you assign, so ",l.createElement(t.code,null,"X-Forwarded-Groups")," carries those values too. They donât match any role ",l.createElement(t.code,null,"entries"),", so they grant no permissions. Avoid naming a roleâs ",l.createElement(t.code,null,"entries")," after them. Giving your role-mapped Groups app-specific names like ",l.createElement(t.code,null,"jenkins-admin")," sidesteps the issue entirely.")),"\n",l.createElement(t.h1,{id:"how-it-works",style:{position:"relative"}}
1,l.createElement(t.a,{href:"#how-it-works","aria-label":"how it works permalink",className:"remark-autolink-anchor before"},l.createElement(t.span,{dangerouslySetInnerHTML:{__html:'<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M13.3771 7.86873C14.1377 7.10819 15.3708 7.10819 16.1313 7.86873C16.8918 8.62927 16.8918 9.86235 16.1313 10.6229L14.2952 12.459C14.0417 12.7125 14.0417 13.1235 14.2952 13.3771C14.5487 13.6306 14.9597 13.6306 15.2132 13.3771L17.0493 11.5409C18.3169 10.2734 18.3169 8.21824 17.0493 6.95068C15.7818 5.68311 13.7266 5.68311 12.4591 6.95068L10.623 8.78678C10.3695 9.0403 10.3695 9.45132 10.623 9.70484C10.8765 9.95835 11.2875 9.95835 11.541 9.70484L13.3771 7.86873Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.1639 13.8361C9.9104 13.5826 9.9104 13.1716 10.1639 12.9181L12.9181 10.1639C13.1716 9.9104 13.5826 9.9104 13.8361 10.1639C14.0896 10.4174 14.0896 10.8285 13.8361 11.082L11.082 13.8361C10.8285 14.0896 10.4174 14.0896 10.1639 13.8361Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M7.86873 13.3771C7.10819 14.1377 7.10819 15.3707 7.86873 16.1313C8.62927 16.8918 9.86235 16.8918 10.6229 16.1313L12.459 14.2952C12.7125 14.0417 13.1235 14.0417 13.3771 14.2952C13.6306 14.5487 13.6306 14.9597 13.3771 15.2132L11.5409 17.0493C10.2734 18.3169 8.21824 18.3169 6.95068 17.0493C5.68311 15.7818 5.68311 13.7266 6.95068 12.4591L8.78678 10.623C9.0403 10.3694 9.45132 10.3694 9.70484 10.623C9.95835 10.8765 9.95835 11.2875 9.70484 11.541L7.86873 13.3771Z" fill="#A1A1AA"/></svg>'}})),"How It Works"),"\n",l.createElement(t.p,null,"On each request, the Gateway injects ",l.createElement(t.code,null,"X-Forwarded-User")," and ",l.createElement(t.code,null,"X-Forwarded-Groups"),", then forwards to Jenkins. The Reverse Proxy Auth realm reads the username from ",l.createElement(t.code,null,"X-Forwarded-User")," and the Group list from ",l.createElement(t.code,null,"X-Forwarded-Groups"),", exposing the Groups as Jenkins âauthorities.â Role-Based Strategy then matches those authorities against the ",l.createElement(t.code,null,"entries")," in each role and grants the roleâs permissions."),"\n",l.createElement(t.p,null,"Because permissions come from the Group header, moving a user between Twingate Groups changes their Jenkins access on the next request. A user in ",l.createElement(t.code,null,"jenkins-admin")," gets Manage Jenkins, while a user in ",l.createElement(t.code,null,"jenkins-viewer")," gets read-only access with the admin menus hidden."),"\n",l.createElement(t.h1,{id:"security",style:{position:"relative"}},l.createElement(t.a,{href:"#security","aria-label":"security permalink",className:"remark-autolink-anchor before"},l.createElement(t.span,{dangerouslySetInnerHTML:{__html:'<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M13.3771 7.86873C14.1377 7.10819 15.3708 7.10819 16.1313 7.86873C16.8918 8.62927 16.8918 9.86235 16.1313 10.6229L14.2952 12.459C14.0417 12.7125 14.0417 13.1235 14.2952 13.3771C14.5487 13.6306 14.9597 13.6306 15.2132 13.3771L17.0493 11.5409C18.3169 10.2734 18.3169 8.21824 17.0493 6.95068C15.7818 5.68311 13.7266 5.68311 12.4591 6.95068L10.623 8.78678C10.3695 9.0403 10.3695 9.45132 10.623 9.70484C10.8765 9.95835 11.2875 9.95835 11.541 9.70484L13.3771 7.86873Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.1639 13.8361C9.9104 13.5826 9.9104 13.1716 10.1639 12.9181L12.9181 10.1639C13.1716 9.9104 13.5826 9.9104 13.8361 10.1639C14.0896 10.4174 14.0896 10.8285 13.8361 11.082L11.082 13.8361C10.8285 14.0896 10.4174 14.0896 10.1639 13.8361Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M7.86873 13.3771C7.10819 14.1377 7.10819 15.3707 7.86873 16.1313C8.62927 16.8918 9.86235 16.8918 10.6229 16.1313L12.459 14.2952C12.7125 14.0417 13.1235 14.0417 13.3771 14.2952C13.6306 14.5487 13.6306 14.9597 13.3771 15.2132L11.5409 17.0493C10.2734 18.3169 8.21824 18.3169 6.95068 17.0493C5.68311 15.7818 5.68311 13.7266 6.95068 12.4591L8.78678 10.623C9.0403 10.3694 9.45132 10.3694 9.70484 10.623C9.95835 10.8765 9.95835 11.2875 9.70484 11.541L7.86873 13.3771Z" fill="#A1A1AA"/></svg>'}})),"Security"),"\n",l.createElement(t.p,null,"Trusted-header realms normally make you hand-roll the guarantee that the header can only come from your proxy. With Twingate you donât. The Jenkins Resource is reachable only through the Gateway, and the Gateway overwrites any client-supplied ",l.createElement(t.code,null,"X-Forwarded-User")," or ",l.createElement(t.code,null,"X-Forwarded-Groups"),", so a forged header never reaches Jenkins. See ",l.createElement(t.a,{href:"/docs-assets/5f397c1/docs/web-app-integrations#security-model"},"Web App Integrations")," for the full model."),"\n",l.createElement(t.h1,{id:"next-steps",style:{position:"relative"}}
1,l.createElement(t.a,{href:"#next-steps","aria-label":"next steps permalink",className:"remark-autolink-anchor before"},l.createElement(t.span,{dangerouslySetInnerHTML:{__html:'<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M13.3771 7.86873C14.1377 7.10819 15.3708 7.10819 16.1313 7.86873C16.8918 8.62927 16.8918 9.86235 16.1313 10.6229L14.2952 12.459C14.0417 12.7125 14.0417 13.1235 14.2952 13.3771C14.5487 13.6306 14.9597 13.6306 15.2132 13.3771L17.0493 11.5409C18.3169 10.2734 18.3169 8.21824 17.0493 6.95068C15.7818 5.68311 13.7266 5.68311 12.4591 6.95068L10.623 8.78678C10.3695 9.0403 10.3695 9.45132 10.623 9.70484C10.8765 9.95835 11.2875 9.95835 11.541 9.70484L13.3771 7.86873Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M10.1639 13.8361C9.9104 13.5826 9.9104 13.1716 10.1639 12.9181L12.9181 10.1639C13.1716 9.9104 13.5826 9.9104 13.8361 10.1639C14.0896 10.4174 14.0896 10.8285 13.8361 11.082L11.082 13.8361C10.8285 14.0896 10.4174 14.0896 10.1639 13.8361Z" fill="#A1A1AA"/><path fill-rule="evenodd" clip-rule="evenodd" d="M7.86873 13.3771C7.10819 14.1377 7.10819 15.3707 7.86873 16.1313C8.62927 16.8918 9.86235 16.8918 10.6229 16.1313L12.459 14.2952C12.7125 14.0417 13.1235 14.0417 13.3771 14.2952C13.6306 14.5487 13.6306 14.9597 13.3771 15.2132L11.5409 17.0493C10.2734 18.3169 8.21824 18.3169 6.95068 17.0493C5.68311 15.7818 5.68311 13.7266 6.95068 12.4591L8.78678 10.623C9.0403 10.3694 9.45132 10.3694 9.70484 10.623C9.95835 10.8765 9.95835 11.2875 9.70484 11.541L7.86873 13.3771Z" fill="#A1A1AA"/></svg>'}})),"Next Steps"),"\n",l.createElement(t.ul,null,"\n",l.createElement(t.li,null,l.createElement(t.a,{href:"/docs-assets/5f397c1/docs/web-app-grafana"},"Grafana integration guide")," for another trusted-header app"),"\n",l.createElement(t.li,null,l.createElement(t.a,{href:"/docs-assets/5f397c1/docs/web-app-integrations"},"Web App Integrations")," for the shared trusted-header pattern"),"\n",l.createElement(t.li,null,l.createElement(t.a,{href:"/docs-assets/5f397c1/docs/web-app-access#request-headers"},"Identity Firewall for Web Apps overview")," for all available header template variables"),"\n"),"\n",l.createElement(t.p,null,"Join us in the ",l.createElement(t.a,{href:"//www.reddit.com/r/twingate"},"community subreddit")," to share your setup or ask questions."))}var i=function(e){void 0===e&&(e={});const{wrapper:t}=Object.assign({},(0,a.RP)(),e.components);return t?l.createElement(t,e,l.createElement(r,e)):r(e)};var o=n(35309),s=n(71623),d=n(84343),c=n(48291),u=n(17816),m=n(75131),p=n(22792),h=n(43611),g=n(63377),f=n(42452),C=n(1805),w=n(2976),v=n(64190),E=n(83900),y=n(43285),A=n(22009),L=n(28789),k=n(61540),x=n(21145),b=n(16204),j=n(35935),G=n(74848);function T(e){var t,n,l,a,r,i;const{data:o,location:d,pageContext:u}=e,{mdx:p,docsSocialImage:h}=o,g=null==p||null===(t=p.frontmatter)||void 0===t?void 0:t.title,f=(null==p||null===(n=p.frontmatter)||void 0===n?void 0:n.description)||(null==p||null===(l=p.frontmatter)||void 0===l?void 0:l.subt
1itle),C=null==p||null===(a=p.frontmatter)||void 0===a?void 0:a.keywords,{docsMetadata:w}=(0,b.M)(),v=f||(null==w?void 0:w.description),E=(0,j.f)((0,m.Z)(p),null!==(r=u.navigationTree)&&void 0!==r?r:[],g),A=E.length>1;return(0,G.jsxs)(y.k,{title:g,description:v,keywords:C,pathname:d.pathname,image:null==h||null===(i=h.childImageSharp)||void 0===i?void 0:i.original,children:[(0,G.jsx)(s.d,{mdx:p,pathname:d.pathname,description:v,hasBreadcrumb:A}),(0,G.jsx)(c.g,{path:E,pathname:d.pathname})]})}function M(e){var t,n,l;const{children:a,data:r,pageContext:i,location:s}=e,{mdx:c}=r,{navigationTree:y}=i,b=(0,A._)(),T=null==c?void 0:c.frontmatter,M="two-column"===(null==T||null===(t=T.docs)||void 0===t?void 0:t.layout),I=`https://www.twingate.com${s.pathname}`;let S=null!==(n=null==T||null===(l=T.docs)||void 0===l?void 0:l.aiPrompt)&&void 0!==n?n:`Take a look at this page: ${I} and walk me through it`;S.includes("{{url}}")&&(S=S.replace("{{url}}",I));const Z=[{id:"open-chatgpt",icon:(0,G.jsx)(L.IconChatGPT,{}),label:"Open in ChatGPT",description:"Ask questions about this page",href:`https://chatgpt.com/?hints=search&q=${encodeURIComponent(S)}`},{id:"open-claude",icon:(0,G.jsx)(k.IconClaude,{}),label:"Open in Claude",description:"Ask questions about this page",href:`https://claude.ai/new?q=${encodeURIComponent(S)}`}],R=(0,m.Z)(c),J=null==T?void 0:T.title,_=(0,j.f)(R,y,J),{isVideoOverlayOpen:B}=b;return(0,G.jsx)(A.jx,{value:b,children:(0,G.jsxs)(g.P,{children:[(0,G.jsx)(x.R,{currentPath:_,navItems:y,pathname:s.pathname,visibility:["visible","visible","hidden"],height:["auto","auto",0]}),(0,G.jsx)(C.a,{as:"section",paddingTopSpacing:[3,4,6],paddingBottomSpacing:[4,0],boxSizing:"content-box",children:(0,G.jsx)(w.m,{maxWidth:"xl",disableGutters:!0,children:(0,G.jsxs)(v.x,{gridGap:["0","0","2rem","4rem","6rem","9rem"],gridTemplateColumns:["repeat(12, 1fr)","repeat(12, 1fr)","248px minmax(0, 1fr) 240px","248px minmax(0, 1fr) 240px","248px minmax(0, 1fr) 240px"],children:[(0,G.jsx)(C.a,{display:["none","none","block"],gridColumn:"1 / span 1",height:"calc(100vh - 5rem - 3rem)",overflow:"auto",position:"sticky",top:"7rem",children:(0,G.jsx)(p.S,{overflow:"hidden",pathname:s.pathname,items:y,paddingRightSpacing:[0,0],paddingBottomSpacing:2})}),(0,G.jsxs)(C.a,{gridColumn:["1 / span 12","1 / span 12","2 / span 2",M?"2 / span 2":"2 / span 1"],style:{maxWidth:"840px"},children:[(0,G.jsxs)(C.a,{display:"flex",flexDirection:["column-reverse","row","row","column"],justifyContent:["flex-start","space-between","space-between","flex-start"],marginBottomSpacing:[2,3,2,0],children:[(0,G.jsx)(C.a,{children:(0,G.jsx)(o.n,{mdx:c,path:_})}),!M&&(0,G.jsx)(C.a,{display:["block","block","block","none"],marginTopSpacing:[1,2,5],children:(0,G.jsx)(f.W,{items:Z,triggerLabel:"Open with AI"})})]}),B&&(0,G.jsx)(C.a,{position:"absolute",width:"100%",height:"100%",left:"0",right:"0",top:"0",children:(0,G.jsx)(h.O,{})}),a&&(0,G.jsx)(C.a,{marginTopSpacing:4,marginBottomSpacing:7,children:(0,G.jsx)(E.b,{children:a})}),(0,G.jsx)(d.n,{mdx:c})]}),!M&&(0,G.jsx)(C.a,{display:["none","none","none","block"],gridColumn:"3 / span 1",children:(0,G.jsxs)(C.a,{position:"sticky",top:"7rem",children:[(0,G.jsx)(C.a,{marginBottomSpacing:3,marginTopSpacing:1,children:(0,G.jsx)(f.W,{items:Z,triggerLabel:"Open with AI"})}),(0,G.jsx)(u.M,{mdx:c,locationHash:s.hash})]})})]})})})]})})}function I(e){return l.createElement(M,e,l.createElement(i,e))}}}]); 2//# sourceMappingURL=1560-47d4c7350db0a43e10b2.js.map
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.