Questions[sonarqube](server)

I have a taks to implement authentication to SonarQube with SAML from Azure AD We are using SonarQube 8.9.6 LTS with openjdk 11.0.14 OpenJDK Runtime Environment build 11.0.14+9 on Ubuntu 20.04. I've set the paramaters from Azure (application ID, Provider ID, SAML Login, X.509 certificate, the correct groups are added etc.) I've also imported the certificate to the java keychain. The config test ran at Azure side is successfull, however when I try to login with SAML I get

You're not authorized to access this page. Please contact the administrator.

And the following error is recorded in SonarQube's web.log

2022.03.09 10:44:26 WARN web[AX9qdufcVwzEhwilAADF][o.s.s.a.AuthenticationError] Failed to retrieve IdentityProvider for key 'saml2' java.lang.IllegalArgumentException: Identity provider saml2 does not exist or is not enabled at org.sonar.server.authentication.IdentityProviderRepository.getEnabledByKey(IdentityProviderRepository.java:54) at org.sonar.server.authentication.AuthenticationFilter.resolveProviderOrHandleResponse(AuthenticationFilter.java:54) at org.sonar.server.authentication.OAuth2CallbackFilter.doFilter(OAuth2CallbackFilter.java:66) at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139) at org.sonar.server.authentication.DefaultAdminCredentialsVerifierFilter.doFilter(DefaultAdminCredentialsVerifierFilter.java:89) at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139) at org.sonar.server.plugins.PluginsRiskConsentFilter.doFilter(PluginsRiskConsentFilter.java:77) at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139) at org.sonar.server.platform.web.MasterServletFilter.doFilter(MasterServletFilter.java:108) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167) at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:81) at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:68) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167) at org.sonar.server.platform.web.CacheControlFilter.doFilter(CacheControlFilter.java:76) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167) at org.sonar.server.platform.web.SecurityServletFilter.doHttpFilter(SecurityServletFilter.java:76) at org.sonar.server.platform.web.SecurityServletFilter.doFilter(SecurityServletFilter.java:48) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167) at org.sonar.server.platform.web.RedirectFilter.doFilter(RedirectFilter.java:58) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167) at org.sonar.server.platform.web.RequestIdFilter.doFilter(RequestIdFilter.java:66) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167) at org.sonar.server.platform.web.RootFilter.doFilter(RootFilter.java:62) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167) at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:544) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143) at ch.qos.logback.access.tomcat.LogbackValve.invoke(LogbackValve.java:256) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:364) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:624) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:831) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1651) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.base/java.lang.Thread.run(Thread.java:829)

I've inspected the SAML traffic and this is what it shows:

€‹<samlp:AuthnRequest AssertionConsumerServiceURL="https://ComapnyDomain.org/oauth2/callback/saml" Destination="https://CompanyDomain.org/oauth2/callback/saml2" ID="ONELOGIN_masked" IssueInstant="2022-03-09T08:45:23Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"> saml:Issuerhttps://CompanyDomain.org</saml:Issuer><samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/></samlp:AuthnRequest>

How to generate sonar report with sonarqube version 9.2.1.49989. Which plugin i need to install for that?

I installed CNES Report .jar plugin to generate sonar report but this plugin(CNES) not supporting could you please help how to generate sonarqube report in latest sonarqube version 9.2.1.49989.

How to get projects having admin users or list of them if multiple admin users on them using API?

I tried few links, but not working.

sonarqube version 8.9, I am using.

Good day everyone !

I have a simple problem, yet, not able to fix it. May I just need more coffee... Most probably...

Anyway...

I am using the official Docker images for SonarQube and need to connect Sonar to my auth server. That auth server can be called on a TLS route (https).

However, since that server is a internal server, it has a cert signed by our internal CA, so I need the Sonar Image to have my root CA added to the image. Which I did in the Docker file

FROM sonarqube
USER root
COPY cert/*.cer /usr/local/share/ca-certificates/
RUN /usr/sbin/update-ca-certificates
USER sonarqube

The Docker image get built, but I am still not able to call my auth server without having a self signed certificat therefore, not trusted error.....

I know the image is based on Debian, this is why I added the RootCA to /usr/local/share/ca-certificates/ ... So, why is this not working.... ?

May be I need to push my RootCA in .pem format directly in /etc/ssl/certs/ ?

I'm using the Sonarqube github authentication plugin. I want to make it so that only users in my Github organisation can sign up.

It does not appear to work because even users that are in my organisation are blocked with the reason:

Reason: 'username' must be a member of at least one organization: 'https://github.com/{{organisation_name}}'

The link above is my organisation page on Github. I have used {{organisation_name}} as the configuration value in Sonarqube. The user is definitely a member of the organisation.

What value should I use for the organisation name?

EDIT: I found https://jira.sonarsource.com/projects/SQAUTHGITH/issues/SQAUTHGITH-16?filter=allopenissues which suggests that possibly the org id is required. Using the Github API to get the organisation id for the user and then using that as a config value does not work either.

EDIT: Looking at the flow I think there might be a bug...

This is the url sending the user to github to get a token

https://github.com/login/oauth/authorize?response_type=code&client_id=123abc&redirect_uri=https://example.com/oauth2/callback/github&scope=user:email,read:org&state=123abc

It looks like there is no scope to read the org?