SONARQUBEE 10.1 - Podman/Docker - Failed to authenticate with proxy

Hello,

I succeeded deploying SonarQube EE 10.1 on Podman environment with ansible.

My LDAP connection works fine, but when I try to reach the update center I received the failed authentication on my Proxy.
I tried plenty of solutions available on the internet with the setup of several parameters unsuccessfully.

  • With or without: jdk.http.auth.tunneling.disabledSchemes & jdk.http.auth.proxying.disabledSchemes
  • I try to set or not all proxy information describe here: Environment variables
  • I try also to set http & https proxy in var pod env.
  • I also try to use the sonar.propertie file to avoid to use --env parameters

What I can confirm:
The user and password is not send to the proxy authentication
image

In my old version of SonarQube community on docker, I have the correct authentication:

My setup:

  • podman version 4.4.1
  • sonarqube:10.1.0-enterprise
  • database: postgres:15.3-alpine
  • input traefik: traefik:v2.10.4

Env:

sonarqube@7df9ce24de95:/opt/sonarqube$ java --version
openjdk 17.0.8 2023-07-18
OpenJDK Runtime Environment Temurin-17.0.8+7 (build 17.0.8+7)
OpenJDK 64-Bit Server VM Temurin-17.0.8+7 (build 17.0.8+7, mixed mode, sharing)

My service start:

ExecStart=/usr/bin/podman container run \
        --cidfile=%t/%n.ctr-id \
        --cgroups=no-conmon \
        --rm \
        --sdnotify=conmon \
        --replace \
        --name sonarqube \
        --network bridge \
        --env "SONAR_JDBC_USERNAME=sonar" \
        --env "SONAR_JDBC_PASSWORD=xxxxx" \
        --env "SONAR_JDBC_URL=jdbc:postgresql://xxxxxxx:5432/sonar" \
        --env "SONAR_CORE_SERVERBASEURL=https://xxxxxx.com" \
        --env "SONAR_WEB_HTTP_MINTHREADS=5" \
        --env "SONAR_WEB_HTTP_ACCEPTCOUNT=25" \
        --env "SONAR_WEB_HTTP_KEEPALIVETIMEOUT=60000" \
        --env "SONAR_WEB_SESSIONTIMEOUTINMINUTES=480" \
        --env "SONAR_WEB_JAVAOPTS=-Xmx1g -Xms1g -XX:+HeapDumpOnOutOfMemoryError" \
        --env "SONAR_WEB_JAVAADDITIONALOPTS=-Djava.net.preferIPv4Stack=true -Djdk.http.auth.tunneling.disabledSchemes= -Djdk.http.auth.proxying.disabledSchemes= " \
        --env "SONAR_CE_JAVAOPTS=-Xmx2g -Xms2g" \
        --env "SONAR_CE_JAVAADDITIONALOPTS=-XX:+HeapDumpOnOutOfMemoryError  -Djdk.http.auth.tunneling.disabledSchemes= -Djdk.http.auth.proxying.disabledSchemes= " \
        --env "SONAR_SECURITY_REALM=LDAP" \
        --env "LDAP_URL=ldap://xxxxx:yyyyy" \
        --env "LDAP_BINDDN=ulosvc@xxxxxx.com" \
        --env "LDAP_BINDPASSWORD=xxxxxxxxxxx" \
        --env "LDAP_USER_BASEDN=DC=xxxx,DC=xxxxxx-net,DC=com" \
        --env "LDAP_USER_REALNAMEATTRIBUTE=sAMAccountName" \
        --env "LDAP_USER_REQUEST=(&(objectClass=user)(|(memberOf=CN=xxxxxxx,OU=Groupes,OU=xxxx,DC=xxxxx,DC=xxxxxx-net,DC=com))(sAMAccountName={login}))" \
        --env "HTTP_PROXYHOST=proxy.xxxxxxx.com" \
        --env "HTTPS_PROXYHOST=proxy.xxxxxxx.comm" \
        --env "HTTP_PROXYPORT=8080" \
        --env "HTTPS_PROXYPORT=8080" \
        --env "HTTP_PROXYUSER=Proxy-xxxxx" \
        --env "HTTP_PROXYPASSWORD=xxxxxxx" \
        --env "HTTPS_PROXYUSER=Proxy-xxxxx" \
        --env "HTTPS_PROXYPASSWORD=xxxxxxx" \
        --env "SONAR_SEARCH_JAVAOPTS=-Xmx4g -Xms4g" \
        --env "SONAR_SEARCH_JAVAADDITIONALOPTS=-XX:+HeapDumpOnOutOfMemoryError" \
        --env "SONAR_CE_PARALLELPROJECTTASKS=True" \
        --label traefik.enable=true \
        --label traefik.http.routers.sonarqube.rule=Host(`xxxxxx.com`) \
        --label traefik.http.routers.sonarqube.entrypoints=https \
        --label traefik.http.routers.sonarqube.tls=true \
        --label traefik.http.routers.sonarqube.tls.options=myTLSOptions@file \
        --label traefik.http.services.sonarqube.loadbalancer.server.port=9000 \
        --publish 9000:9000 \
        --volume sonarqube_data:/opt/sonarqube/data:rw,U \
        --volume sonarqube_logs:/opt/sonarqube/logs:rw,U \
        --volume sonarqube_extensions_plugins:/opt/sonarqube/extensions:rw,U \
        --detach=True sonarqube:10.1.0-enterprise

Sonarqube log:

2023.09.04 12:39:51 ERROR web[AYpgNL31HNLjkonIAAAb][o.s.s.p.UpdateCenterClient] Fail to connect to update center
org.sonar.api.utils.SonarException: Fail to download: https://update.sonarsource.org/update-center.properties
        at org.sonar.core.util.DefaultHttpDownloader.failToDownload(DefaultHttpDownloader.java:151)
        at org.sonar.core.util.DefaultHttpDownloader.readString(DefaultHttpDownloader.java:107)
        at org.sonar.api.utils.UriReader.readString(UriReader.java:69)
        at org.sonar.server.plugins.UpdateCenterClient.init(UpdateCenterClient.java:111)
        at org.sonar.server.plugins.UpdateCenterClient.getUpdateCenter(UpdateCenterClient.java:94)
        at org.sonar.server.plugins.UpdateCenterMatrixFactory.getUpdateCenter(UpdateCenterMatrixFactory.java:44)
        at org.sonar.server.plugins.ws.AvailableAction.handle(AvailableAction.java:84)
        at org.sonar.server.ws.WebServiceEngine.execute(WebServiceEngine.java:111)
        at org.sonar.server.platform.web.WebServiceFilter.doFilter(WebServiceFilter.java:84)
        at org.sonar.server.platform.web.MasterServletFilter$JavaxFilterAdapter.doFilter(MasterServletFilter.java:227)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:198)
        at org.sonar.server.platform.web.MasterServletFilter$HttpFilterChainAdapter.doFilter(MasterServletFilter.java:241)
        at org.sonar.server.platform.web.SonarLintConnectionFilter.doFilter(SonarLintConnectionFilter.java:66)
        at org.sonar.server.platform.web.MasterServletFilter$JavaxFilterAdapter.doFilter(MasterServletFilter.java:227)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:198)
        at org.sonar.server.platform.web.MasterServletFilter.doFilter(MasterServletFilter.java:146)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:83)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:70)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.sonar.server.platform.web.CspFilter.doFilter(CspFilter.java:63)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.sonar.server.platform.web.CacheControlFilter.doFilter(CacheControlFilter.java:76)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.sonar.server.platform.web.SecurityServletFilter.doHttpFilter(SecurityServletFilter.java:60)
        at org.sonar.server.platform.web.SecurityServletFilter.doFilter(SecurityServletFilter.java:47)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.sonar.server.platform.web.RedirectFilter.doFilter(RedirectFilter.java:57)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.sonar.server.platform.web.RequestIdFilter.doFilter(RequestIdFilter.java:66)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.sonar.server.platform.web.RootFilter.doFilter(RootFilter.java:65)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:115)
        at jdk.internal.reflect.GeneratedMethodAccessor34.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:176)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:137)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:136)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:481)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130)
        at ch.qos.logback.access.tomcat.LogbackValve.invoke(LogbackValve.java:262)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:389)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:926)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1791)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.base/java.lang.Thread.run(Unknown Source)
Caused by: java.io.IOException: Failed to authenticate with proxy
        at okhttp3.internal.connection.RealConnection.createTunnel(RealConnection.kt:476)
        at okhttp3.internal.connection.RealConnection.connectTunnel(RealConnection.kt:262)
        at okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:201)
        at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:226)
        at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:106)
        at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.kt:74)
        at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:255)
        at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:95)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76)
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109)
        at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:201)
        at okhttp3.internal.connection.RealCall.execute(RealCall.kt:154)
        at org.sonar.core.util.DefaultHttpDownloader.executeCall(DefaultHttpDownloader.java:147)
        at org.sonar.core.util.DefaultHttpDownloader.readString(DefaultHttpDownloader.java:104)
        ... 149 common frames omitted

Hey there.

I would normally write this off as configuration-related, but it looks like v10.1 brought some substantial changes to DefaultHttpDownloader. I’ve flagged this for attention.

Hi @LOIC_BOURGEOIS ,

Do you have any other connections coming from SonarQube via proxy , (e.g. DevOps platform integrations) and do they work as expected with the authentication via proxy?

Hello,

My others connections are to internal application: gitlab and cie so they don’t need proxy setup

One difference between my both instance of sonar on the process view is:
On podman : on the main process I have not proxy setup

On Docker: on the main process I have proxy setup

But I don’t understand where came from the parameters because there are correctly set to the other sonarqube process

hi @LOIC_BOURGEOIS
And does SonarQube 10.1 run correctly with docker rather than podman?

Hello

My goal is to have a new instance in podman. And not a new instance in docker so I did not implement this case. And I will not upgrade my current docker instance to this version.

But I understand the reason of your proposal.

Regards

I have also upgraded to 10.0.2, but no change.
I have made test with wget inside the pod:
I confirm what I said before:
If I do wget to https://www.google.com or to https://update.sonarsource.org/update-center.properties I have the Basic proxy-authorization, but when it is done by sonar no authorization in the network workflow about it.

Hello Loic,
I have the same issue but with docker, it was reported here and also here
It seems the okhttp proxy authentication doesn’t work or user / pwd is not get by it.
regards

It is indeed a bug in SonarQube.
I’ve created a ticket to track it SONAR-20540

Thanks @wojtek.wajerowicz for the case.
I became crazy to not understanding the origin of my trouble.
I will follow the SonarQube case and cross fingers for the next version.

Hello @wojtek.wajerowicz,

I can see in the JIRA Sonar ask more details about the subject. I have no autorization to do add comment, so can you add them.

Regards,