Early access. This feature is in early access, which means it’s undergoing ongoing testing and development while we gather feedback, validate functionality, and improve outputs. Contact the ConductorOne Support team if you’d like to try it out or share feedback.
Create a federation trust
On the service principal detail page, select the Federation tab.
Choose a provider. Select an existing provider, or create a new one. ConductorOne includes presets for common platforms:| Provider | Issuer URL | Notes |
|---|
| GitHub Actions | https://token.actions.githubusercontent.com | Fixed issuer URL |
| GitLab CI/CD | https://gitlab.com (or self-managed URL) | Editable issuer URL |
| HCP Terraform | https://app.terraform.io (or custom hostname) | Editable issuer URL |
| AWS IAM Outbound | Account-specific issuer URL | Editable issuer URL |
| Custom OIDC | Any HTTPS issuer URL | For other OIDC-capable platforms |
Configure the trust. The wizard generates a CEL expression based on your inputs (organization, repository, branch, environment, and so on). You can switch to manual mode to write your own CEL expression.Optional. Add IP restrictions and scoped roles for additional security. See security controls for details. Copy the client ID — you’ll need it in your CI/CD configuration.
Test your token
Before deploying to production, test the federation trust to make sure your CEL expression matches the expected JWT claims.
Click the trust in the Federation tab to open its detail drawer, then click Test.
Paste a sample JWT from your CI/CD platform, or provide claims as JSON.
The test runner validates each step:| Step | What it checks |
|---|
| JWT decode | Token is valid JWT format |
| Issuer match | Token issuer matches the provider |
| Signature validation | Token signature is valid via JWKS |
| Audience validation | Token audience matches your tenant |
| Token freshness | Token was issued within the last 10 minutes |
| CEL evaluation | Your condition expression returns true |
| IP address check | Source IP is in the allowlist (if configured) |
You can also use the Test CEL tool at Settings > Workload Federation to test expressions against sample claims without a real JWT. This is useful for iterating on your CEL expression before creating a trust.
