---
title: Jfrog Artifactory
slug: docs/jfrog-artifactory
description: Scan Jfrog Artifactory for secrets with TruffleHog
icon: {"faIcon":"fa-solid fa-box-archive"}
docTags: 
createdAt: 2024-04-17T14:47:59.126Z
---

# Jfrog Artifactory

:::BlockQuote
**Edition:** Enterprise only and Self-Hosted and Hosted Scanner
:::

The Artifactory integration scans artifacts stored in JFrog Artifactory repositories for credentials and other sensitive data.

## Configuration

The Artifactory integration can be configured in TruffleHog under **Integrations**, or via a local configuration file (below).

### Web configuration

Configure this integration from the **Integrations** page in TruffleHog. You'll need credentials appropriate to your Artifactory instance — see the local configuration section below for the supported authentication methods.

### Local configuration

Local configuration supports two authentication methods:

- **Access token** — uses an Artifactory access token, recommended for a read-only service account.
- **Basic auth** — uses a username and password (or API key, or access token as the password).

**Creating a read-only service account.** Both auth methods work best with a dedicated read-only account:

1. In Artifactory, navigate to **Identity and Access** and create a new user.
2. Leave all roles unchecked. Ensure the user is added to the readers group (selected by default).
3. After creating the user, open the **Access Tokens** tab and generate a token.

**Access token**

:::BlockQuote
sources:
  \- connection:
      "@type": type.googleapis.com/sources.Artifactory
      endpoint: https\://example.jfrog.io
      accessToken: XXXXXXXXXXXXXX
      ignorePaths:
        \- third\_party/drivers/\*
    name: Artifactory repository artifacts
    scanPeriod: 12h
    type: SOURCE\_TYPE\_JFROG\_ARTIFACTORY
    verify: true
:::

**Basic auth**

The password field accepts an access token, API key, or account password.

:::BlockQuote
sources:
  \- connection:
      "@type": type.googleapis.com/sources.Artifactory
      endpoint: https\://example.jfrog.io
      basicAuth:
        username: scanner-account
        password: XXXXXXXXXXXXXX
      ignorePaths:
        \- third\_party/drivers/\*
    name: Artifactory repository artifacts
    scanPeriod: 12h
    type: SOURCE\_TYPE\_JFROG\_ARTIFACTORY
    verify: true
:::

### Scope with includePaths and ignorePaths

Path filters control which artifacts within a repository are scanned. The two fields combine as follows:

- **includePaths only** — only artifacts matching the include list are scanned.
- **ignorePaths only** — all artifacts are scanned except those matching the ignore list.
- **Both specified** — artifacts must match includePaths and must not match ignorePaths.

Paths should not include a repository qualifier. If example is the repository name and the directory to include is example/path/to/dir, the includePaths value should be path/to/dir/\*.

Paths apply to **all repositories in the configuration**. To scope a path to a specific repository, configure a separate Artifactory source for that repository.

## Configuration options

| Field        | Type   | Required | Description                                                                   |
| ------------ | ------ | -------- | ----------------------------------------------------------------------------- |
| endpoint     | string | Yes      | The URL for your Artifactory instance.                                        |
| repositories | list   | No       | Explicit list of Artifactory repositories to scan. Omit to enumerate instead. |
| includePaths | list   | No       | Artifact paths to include in scans. Supports glob patterns (\*).              |
| ignorePaths  | list   | No       | Artifact paths to skip during scans. Supports glob patterns (\*).             |

## Capabilities

| Feature                   | Supported |
| ------------------------- | --------- |
| Scan artifacts            | ✅         |
| Scan archive files        | ✅         |
| Scan base64-encoded data  | ✅         |
| Scan binaries             | ✅         |
| Include / exclude filters | ✅         |
| Auto-resume               | ✅         |