Bitbucket Pipelines can issue OIDC tokens for a workspace. Each workspace has its own identity provider URL. You copy that URL and the audience from repository settings. You can also require a repository UUID.
The discovery document exists only after Pipelines OIDC is enabled and one pipeline has run.
Docs and discovery
| Docs | Integrate Pipelines with resource servers using OIDC |
| Issuer | https://api.bitbucket.org/2.0/workspaces/<workspace>/pipelines-config/identity/oidc |
| Discovery | <issuer>/.well-known/openid-configuration |
Copy both values from Repository, Settings, Pipelines, OpenID Connect. A step can also set a custom audience in its oidc config.
Token
| Issuer | The workspace identity provider URL |
| Audience | Usually ari:cloud:bitbucket::workspace/… |
| Repository | repositoryUuid, optional, brace-wrapped |
A custom audience does not name the workspace. Add a repository UUID if you use one.
Fields
| Field | Claim | Required | Validation |
|---|---|---|---|
| Identity provider URL | iss | Yes | The workspace OIDC URL from settings. |
| Audience | aud | Yes | Same settings page. |
| Repository UUID | repositoryUuid | No | Optional. {uuid} or a bare UUID. |
| Additional claims | other | No | Cannot reuse aud or repositoryUuid. |
Example policy
{
issuer:
"https://api.bitbucket.org/2.0/workspaces/acme/pipelines-config/identity/oidc",
claims: {
aud: ["ari:cloud:bitbucket::workspace/123"],
repositoryUuid: ["{9a8b}"],
},
}Add a field
Edit components/oidc/provider-bitbucket.tsx after install. For a one-off claim, use Additional claims. For its own input, add it to Fields (or schema), DEFAULTS, compile, parse, FIRST_CLASS_CLAIMS, and the form.
See Add a field.