Jenkins downloads the avatar from the provider and serves it itself, so the provider only needs to be reachable from the controller and no third-party domain is added to the img-src Content Security Policy directive. Only GIF, JPEG and PNG images are accepted, and images of 5 MB or more are rejected. The download happens in the background, so logins are not delayed by it; once it completes the image is served by Jenkins from /user/<id>/oic-avatar/image.