Operations Automation

X-Forwarded-User / REMOTE_USER

Zero-Day Shield

SSO + Zero-Day Protection for Rundeck

by PagerDuty (Rundeck)

Add SAML/OIDC SSO to Rundeck via Authenticated Proxy — Protect Operations Automation from Zero-Day Exploits

Overview

Why Rundeck Needs an Authenticated Proxy

Rundeck is an operations automation platform that enables teams to define, execute, and manage routine operational procedures as self-service jobs. Rundeck jobs typically have privileged access to production infrastructure — executing commands on servers, managing deployments, and orchestrating workflows that touch critical systems. A compromised Rundeck instance gives attackers the ability to execute arbitrary commands across your infrastructure. OnePAM adds enterprise SSO and zero-day protection by placing an authenticated reverse proxy in front of Rundeck. Users authenticate via your corporate IdP, and OnePAM handles the identity injection via Rundeck's preauthenticated mode. No unauthenticated user can reach Rundeck, and every job execution is tied to a verified corporate identity.

HTTP Header Authentication

X-Forwarded-User / REMOTE_USER

Rundeck supports preauthenticated mode where it trusts the user identity from an HTTP header set by a trusted reverse proxy. OnePAM injects the authenticated username, and Rundeck creates the session with appropriate role assignments.

Zero-Day Risk Profile

Rundeck Vulnerability Risks

Without an authenticated proxy, these risks are directly exploitable by any network-reachable attacker.

Rundeck has had vulnerabilities allowing unauthorized job execution

Jobs execute with privileged access to production servers and infrastructure

Rundeck key storage contains SSH keys, API tokens, and deployment credentials

Unauthorized job execution can modify or destroy production infrastructure

The Challenge

Security Challenges with Rundeck

These are the risks organizations face when Rundeck is not behind an authenticated proxy.

Privileged Infrastructure Access

Rundeck jobs execute commands on production servers. Unauthorized access means ability to modify, destroy, or exfiltrate production infrastructure.

Credential Storage

Rundeck's key storage contains SSH keys, passwords, and API tokens for production infrastructure. Compromise exposes all stored secrets.

Job Execution Risk

Malicious job execution can deploy compromised code, modify infrastructure configuration, or destroy data across multiple servers simultaneously.

Credential Sprawl

Rundeck has its own user management, creating yet another credential for operations teams to manage.

Audit Complexity

Tracking who executed which job, when, and with what results requires correlating Rundeck logs with identity provider data.

Limited SSO in OSS

Rundeck Community edition has limited SSO options. Full SAML/OIDC support requires Rundeck Enterprise licensing.

The OnePAM Solution

How OnePAM Adds SSO + Zero-Day Protection to Rundeck

A step-by-step guide to deploying OnePAM's authenticated proxy in front of Rundeck.

Deploy OnePAM as Rundeck's Gateway

Place OnePAM in front of Rundeck, making it the sole network entry point.

Rundeck is configured to accept connections only from OnePAM. The Rundeck login page is never directly accessible.

Configure Your IdP

Connect OnePAM to your SAML 2.0 or OIDC identity provider.

OnePAM manages the full authentication flow: IdP redirect, MFA enforcement, assertion validation, and session lifecycle.

Enable Preauthenticated Mode

Configure Rundeck's preauthenticated mode to trust the user identity from OnePAM's HTTP headers.

Rundeck reads the pre-authenticated username and role assignments from OnePAM's headers. Users land on their Rundeck dashboard without a separate login.

Map Roles from IdP Groups

OnePAM passes IdP group memberships that map to Rundeck roles and project ACLs.

Operations teams get job execution access, developers get read-only access, and managers see job history — all controlled from your IdP.

Audit Job Execution

Every Rundeck access and job execution is tied to a verified corporate identity with full audit context.

OnePAM's audit trail + Rundeck's job logs create a complete chain of evidence: who authenticated, from where, and what jobs they executed on which infrastructure.

Business Impact

Benefits of Securing Rundeck with OnePAM

Measurable security and operational outcomes from deploying OnePAM in front of Rundeck.

Protect Operations Automation

Only authenticated, authorized users can reach Rundeck. No unauthenticated access to job execution or infrastructure automation.

Zero unauthorized job execution

SSO for Rundeck Community

OnePAM provides enterprise SSO for Rundeck Community edition — no Rundeck Enterprise licensing required for SAML/OIDC.

Enterprise SSO for free Rundeck

MFA for Production Access

Require multi-factor authentication before any production automation can be triggered or managed.

MFA-gated automation

Identity-Tied Job Execution

Every job execution is linked to a verified corporate identity from your IdP, not a Rundeck-local username.

Identity-bound automation

Instant Access Revocation

Disable a user in your IdP and their ability to execute Rundeck jobs stops immediately.

Real-time deprovisioning

Shield from Rundeck CVEs

Vulnerabilities in Rundeck cannot be exploited by unauthenticated attackers when OnePAM is in the path.

CVEs blocked at proxy

SSO Features

Rundeck SSO Capabilities

Every feature needed to provide enterprise-grade SSO and access control for Rundeck.

SAML 2.0 & OIDC SSO via Rundeck preauthenticated mode

IdP group to Rundeck role and ACL mapping

Project-level access control from IdP attributes

Job execution auditing with IdP identity context

Session recording for compliance

IP and geo-restriction for operations automation access

Device trust verification before job execution

MFA step-up for production job execution

Concurrent session controls

Emergency break-glass access procedures

Security

Zero-Day Protection Features

Enterprise-grade security controls that shield Rundeck from exploitation.

Rundeck isolated from direct network access

End-to-end TLS encryption

Request-level identity verification

Protection against Rundeck exploitation

Key storage credential isolation

Automatic session termination on IdP sign-out

Real-World Scenarios

Rundeck SSO + Security Use Cases

Common scenarios where organizations deploy OnePAM in front of Rundeck.

Operations teams executing production automation jobs via corporate SSO with MFA

Developers running deployment jobs with role-restricted access

NOC teams triggering incident response procedures with audited sessions

Contractors executing specific maintenance jobs with time-limited access

Compliance-driven operations automation auditing for SOC 2 and PCI DSS

Protecting Rundeck from network-based exploitation in hybrid environments

Frequently Asked Questions

Rundeck SSO + Security FAQ

Common questions about deploying OnePAM's authenticated proxy for Rundeck.

Does OnePAM work with Rundeck Community (open source)?

Yes. OnePAM provides enterprise SSO via Rundeck's preauthenticated mode, which is available in both Community and Enterprise editions.

How does preauthenticated mode work?

Rundeck's preauthenticated mode trusts the user identity from an HTTP header set by a trusted upstream proxy. OnePAM authenticates the user via your IdP and injects the verified identity into the header. Rundeck accepts this identity and creates the session.

Can we restrict who can execute specific jobs?

Yes. OnePAM passes IdP group memberships that map to Rundeck project ACLs. Combined with Rundeck's native authorization, you can control who can view, execute, or manage specific jobs.

Does OnePAM affect Rundeck's API access?

OnePAM supports separate policies for Rundeck's API endpoints. Automated integrations can use API tokens while interactive sessions require SSO.

Can we require step-up MFA for production jobs?

Yes. OnePAM can enforce different MFA requirements for different Rundeck paths or projects. Production job execution can require step-up authentication while read-only access uses standard SSO.

Ready to Secure Rundeck with SSO + Zero-Day Protection?

Deploy OnePAM in minutes — no Rundeck code changes required. Start your free 14-day trial today.

Start Free Trial View All Supported Apps