CI/CD Automation

X-Forwarded-User

Zero-Day Shield

SSO + Zero-Day Protection for Woodpecker CI

by Woodpecker CI Community

Add SAML/OIDC SSO to Woodpecker CI — Secure Your Lightweight CI/CD Platform

Overview

Why Woodpecker CI Needs an Authenticated Proxy

Woodpecker CI is a community fork of Drone CI, providing a lightweight, container-native continuous integration engine. Like Drone, Woodpecker executes pipelines in Docker containers and stores build secrets, deployment credentials, and pipeline configurations. OnePAM adds enterprise SSO to Woodpecker, ensuring only authorized developers can trigger builds, view logs, and manage CI/CD secrets.

HTTP Header Authentication

X-Forwarded-User

Woodpecker CI supports authentication via a trusted reverse proxy. OnePAM injects the verified user identity, and Woodpecker maps the session to the authenticated developer.

Zero-Day Risk Profile

Woodpecker CI Vulnerability Risks

Without an authenticated proxy, these risks are directly exploitable by any network-reachable attacker.

Woodpecker pipelines execute arbitrary code in containers

Build secrets and deployment credentials can be exfiltrated via pipelines

Pipeline configurations can be modified to inject malicious code

Container escape vulnerabilities in runners can compromise hosts

The Challenge

Security Challenges with Woodpecker CI

These are the risks organizations face when Woodpecker CI is not behind an authenticated proxy.

Supply Chain Attack Surface

Woodpecker controls your build pipeline. Compromised access means attackers can inject code into every software release.

Secret Management

Build secrets, registry credentials, and deployment tokens stored in Woodpecker are accessible to pipeline authors.

Git-Only OAuth

Woodpecker's built-in auth relies on Git provider OAuth. Enterprise SAML/OIDC SSO is not natively supported.

Pipeline Modification

Unauthorized users could modify pipeline files to run malicious commands during builds.

Container Risks

Pipelines run in Docker containers. Privileged containers or volume mounts can expose the host system.

Limited Audit Logging

Tracking who triggered builds, accessed secrets, or modified configurations requires external tooling.

The OnePAM Solution

How OnePAM Adds SSO + Zero-Day Protection to Woodpecker CI

A step-by-step guide to deploying OnePAM's authenticated proxy in front of Woodpecker CI.

Deploy OnePAM as Woodpecker Proxy

Place OnePAM in front of the Woodpecker CI web interface.

Woodpecker accepts connections only from OnePAM. All interactive access is authenticated.

Configure Your Identity Provider

Connect OnePAM to your SAML/OIDC provider for corporate SSO.

Developers authenticate via your IdP with MFA before accessing CI/CD functionality.

Enable Proxy Authentication

OnePAM injects verified identity headers for Woodpecker.

Individual developer accountability for every build, secret access, and configuration change.

Define CI/CD Access Policies

Control build triggers, secret visibility, and admin functions by IdP group.

Developers trigger builds; SREs manage secrets; admins configure runners.

Audit Build Activity

Every CI/CD interaction logged with corporate identity.

Complete audit trail for supply chain security and compliance.

Business Impact

Benefits of Securing Woodpecker CI with OnePAM

Measurable security and operational outcomes from deploying OnePAM in front of Woodpecker CI.

Enterprise SSO for CI/CD

Add SAML/OIDC SSO to Woodpecker without modifying the application.

Corporate SSO for builds

Protect Build Secrets

Deployment credentials and API keys protected behind enterprise authentication.

Zero secret exposure

Supply Chain Security

Only authorized developers can trigger builds and modify pipeline configurations.

Authenticated builds only

Individual Accountability

Every build trigger attributed to a specific developer.

Individual accountability

Instant Offboarding

Disable a developer in your IdP and CI/CD access stops immediately.

Real-time revocation

Complete Audit Trail

Build triggers, secret access, and config changes logged with identity.

Full CI/CD audit trail

SSO Features

Woodpecker CI SSO Capabilities

Every feature needed to provide enterprise-grade SSO and access control for Woodpecker CI.

SAML 2.0 & OIDC SSO for Woodpecker CI

Build trigger access control by IdP group

Secret visibility policies per team

Session recording for compliance

IP and geo-restriction

Device trust verification

Time-based deployment windows

Pipeline configuration auditing

Multi-organization support

API access control

Security

Zero-Day Protection Features

Enterprise-grade security controls that shield Woodpecker CI from exploitation.

Woodpecker isolated from direct network access

End-to-end TLS encryption

Request-level authentication

Build secret access auditing

Header injection prevention

Automatic session invalidation on IdP sign-out

Real-World Scenarios

Woodpecker CI SSO + Security Use Cases

Common scenarios where organizations deploy OnePAM in front of Woodpecker CI.

Development teams using Woodpecker CI with corporate SSO

Securing build secrets and deployment credentials

Auditing build triggers for supply chain compliance

Restricting production deployments to authorized engineers

Providing read-only build log access to QA teams

Migrating from Drone CI while maintaining SSO integration

Frequently Asked Questions

Woodpecker CI SSO + Security FAQ

Common questions about deploying OnePAM's authenticated proxy for Woodpecker CI.

How is Woodpecker CI different from Drone CI?

Woodpecker CI is a community fork of Drone CI. OnePAM provides the same SSO and security capabilities for both platforms.

Does OnePAM work with Woodpecker's agent mode?

Yes. OnePAM secures the Woodpecker server web interface. Agents communicate directly with the server on the internal network.

Can we use Woodpecker CLI with OnePAM?

Yes. OnePAM can allow API token authentication for the CLI while requiring SSO for web access.

Does OnePAM handle Woodpecker webhooks?

Yes. Git provider webhooks can be routed to bypass SSO while human requests require authentication.

Can we migrate from Drone CI to Woodpecker with OnePAM?

Yes. OnePAM provides the same SSO integration pattern for both platforms, making migration seamless.

Ready to Secure Woodpecker CI with SSO + Zero-Day Protection?

Deploy OnePAM in minutes — no Woodpecker CI code changes required. Start your free 14-day trial today.

Start Free Trial View All Supported Apps