Migrating from Sonar for Ant task 2.7.1 to SonarScanner CLI - major authentication problems

SonarQube Server / Community Build
, ,
1

Must-share information (formatted with Markdown):

  • which versions are you using (SonarQube, Scanner, Plugin, and any relevant extension) - Upgrading from Sonar Scanner for Ant task 2.7.1 to SonarScanner CLI 6.1, and also upgrading server from 8.9.6 to 10.6
  • how is SonarQube deployed: zip, Docker, Helm - On Prem server deployment
  • what are you trying to achieve - Resolve issues with token authentication no longer working when upgrading to SonarScanner CLI 6.1
  • what have you tried so far to achieve this - Updated all build processes to generate correct sonar-project.properties file, correctly set attributes, have gone through attempting to use TLS server cert, as I was getting an error “You’re Not Authorized to run analysis”, even though when using the Ant Task 2.7.1, and setting the sonar.login (not sonar.token) properties to my token auth, it works. What gives? Is TLS server cert required when working on prem?

Do not share screenshots of logs – share the text itself (bonus points for being well-formatted)!

Hello,

Our large enterprise organization is currently forcing migration from SonarQube 8.9.6 to Server version 10.6. I manage all integration for the largest internal organization which uses SonarQube in my company. I’m facing a major issue, though. I currently have a project which implements a very customized ant build framework, which I had previously integrated SonarScanner using the Sonar Ant scanner 2.7.1. However, as of SonarQube 10.6, that scanner has been fully deprecated, with documentation stipulating that we must move to using the SonarScanner CLI 6.1, since the ant task scanner was simply a wrapper for the CLI in the first place.

So, I’ve done all the work to auto-generate our sonar-project.properties files at the root of every project we build, and scan, which includes my token authentication as the sonar.token property. However, when running the scan, using the same authentication methods as before when using the ant task (IMPORTANT: We have not upgraded the server yet to 10.6!!!), it fails, with the error message: “Caused by: You’re not authorized to run analysis. Please contact the project administrator.”

Down the rabbit hole I went, and discovered that a TLS server cert might the reason why it’s failing. I used openssl to get the server cert, created a trust store, and then generated the property “sonar.scanner.truststorePath”, setting the value to the cert store (sadly, I used pem format, when it should have been DER, because now I’m getting the following error: “Caused by: java.io.IOException: toDerInputStream rejects tag type 45”).

This seems insane, to me. If this is fact, and I can no longer authenticate with a simple token auth, when using SonarScanner CLI 6.1, SonarQube has succeeded in breaking pretty much most integration, especially if mutual TLS is preferred (can you imagine managing hundreds of build clients in that scenario?), for a ton of people in my very situation. We do not use SonarCloud, because we are incredibly data sensitive.

Please HELP! Is there a property I can set to use token authentication when using SonarScanner CLI 6.1, only. Our server still accepts token auth, too. I am right now running jobs with the ant task, using the same server version prior to upgrade, and successfully authenticating with that.

Thank you so much, in advance.

Sincerely,

John Bain

3

Hey there. I understand this issue is important to you, but please follow the community guidelines laid out in our FAQ.

I created a topic, when can I expect a response?

This is an open community with people volunteering their free time to provide assistance. We’re eager to contribute to the community, but you are not guaranteed a fast response.

Be patient

  • Wait a few days before bumping a topic that hasn’t received a response.
  • Do not @name mention individuals not involved in the topic.

You may think it bumps your post to the top of our list, but it does the opposite.

4

Thank you. Will do.

5

Okay, thank you for saying thanks. :slight_smile: Now I can respond, and hopefully put you out of your misery.

This is probably the issue. sonar.token did not exist in SonarQube v8.9.6; it was introduced in SonarQube v10.0. sonar.login still exists in v10.6, but it deprecated, and you’ll get a wee analysis warning.

I don’t know how you fell into the certificate/trust store rabbit hole, but I’m pretty sure you can toss that to the side. It should not be at all relevant.

I hope that’s all there is to it, although I’m a little concerned that you say you also face issues using sonar.login.

However, I am confident the answer lies in some regular config issue (something getting set twice, or with the wrong value, or not at all) and nothing cert-related.

Have a nice weekend.

6

Colin - Thank you so much for pointing out what I completely missed! Lol… So, of course, it’s working now, and I must thank you profusely! Seriously, thank you so much!

“BUILD SUCCESSFUL”

Sincerely,

John

1 Like