because of how SAML works user and password thought and API cal will not work (redirection to the IdP to authenticate), you have to use API tokens that work.

ifernandezcalvo thanks for your help.

I did try to use  an API token generated for the 'jenkins_admin' user but it is the same result. In fact, in my initial post, I tested to use both the password and the API token of the user in place of the "XXXXX" but it behaves the same way.

I just remember that I have seen something about Jenkins CLI on the releases notes https://jenkins.io/blog/2019/02/17/remoting-cli-removed/ there are some services removed on 2.176.2, Which version of Jenkins-CLI you are using? Is it the latest? I'm gonna test it

I have tested the issue with the environment at https://github.com/kuisathaverat/jenkins-issues/tree/master/JENKINS-58809/jenkins-2.176.2, I make the following steps:

1 - start docker-compose environment running the up.sh script
2 - add jenkins.example.com and saml host to my_ /etc/hosts_ pointing to 127.0.0.1
3 - Enter on http://jenkins.example.com:8080 and log in with the user tesla and password password
4 - Create an API Token for the user tesla
5 - run in a terminal the command curl -L $JENKINS_URL'/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)' works as expected, it returns the crumb
6 - run in a terminal the command curl -u tesla:11d8ab0b87fff558fd48ebe51f9c43d352 $JENKINS_URL'/crumbIssuer/api/xml?xpath=concat(//crumbRequestField,":",//crumb)' works as expected, it returns the crumb
7 - run the command java -jar jenkins-cli.jar -s $JENKINS_URL -http -auth tesla:11d8ab0b87fff558fd48ebe51f9c43d352 who-am-i works as expected, it returns the user info

noted that I added the parameter `-http` to the jenkins-cli and I've used the jenkins-cli that comes with Jenkins core 2.176.2 see https://jenkins.io/blog/2017/04/11/new-cli/ , so there is no issue the two request works as expected

Thanks for the help Indeed, the test you indicated is working well.

So maybe in my case the problem comes from Keycloak SAML configuration... ?

Or from the configuration of my reverse-proxy ? (my jenkins is behind an AWS LB + a NGINX reverse-proxy)

Anyway, your test will give me a reference to compare to in my investigation !

Thank you again

ifernandezcalvo FYI (and for people that might encounter the same issue and land on this page), the problem came from 2 points :

• the configuration of the nginx reverse-proxy in front of jenkins (this page helped me : https://wiki.jenkins.io/display/JENKINS/Jenkins+behind+an+NGinX+reverse+proxy)

server {    
  listen 8080;    
  server_tokens off;
  
  location / {
        proxy_pass http://jenkins:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $host;
        proxy_http_version 1.1;
        proxy_request_buffering off;
  }
}

• the "Name ID Format" configured in my SAML IdP provider (Keycloak) that was set to "email" and not to "username" : this attribute is the one that will be referenced in Jenkins as the user login and you must use it in your API authentication (mine was set to "email" so I had to use the email as the user id)

Thank you again for your time