Am o sarcină pentru a implementa autentificarea la SonarQube cu SAML de la Azure AD
Folosim SonarQube 8.9.6 LTS cu openjdk 11.0.14 OpenJDK Runtime Environment build 11.0.14+9 pe Ubuntu 20.04.
Am setat parametrii din Azure (ID aplicație, ID furnizor, Login SAML, certificat X.509, sunt adăugate grupurile corecte etc.)
De asemenea, am importat certificatul în brelocul java.
Testul de configurare a rulat pe partea Azure a reușit, totuși, când încerc să mă autent cu SAML, primesc
Nu sunteți autorizat să accesați această pagină. Vă rugăm să contactați administratorul.
Și următoarea eroare este înregistrată în web.log-ul SonarQube
2022.03.09 10:44:26 WARN web[AX9qdufcVwzEhwilAADF][o.s.s.a.AuthenticationError] Nu s-a putut prelua IdentityProvider pentru cheia „saml2”
java.lang.IllegalArgumentException: Furnizorul de identitate saml2 nu există sau nu este activat
la org.sonar.server.authentication.IdentityProviderRepository.getEnabledByKey(IdentityProviderRepository.java:54)
la org.sonar.server.authentication.AuthenticationFilter.resolveProviderOrHandleResponse(AuthenticationFilter.java:54)
la org.sonar.server.authentication.OAuth2CallbackFilter.doFilter(OAuth2CallbackFilter.java:66)
la org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139)
la org.sonar.server.authentication.DefaultAdminCredentialsVerifierFilter.doFilter(DefaultAdminCredentialsVerifierFilter.java:89)
la org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139)
la org.sonar.server.plugins.PluginsRiskConsentFilter.doFilter(PluginsRiskConsentFilter.java:77)
la org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139)
la org.sonar.server.platform.web.MasterServletFilter.doFilter(MasterServletFilter.java:108)
la org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
la org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
la org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:81)
la org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:68)
la org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
la org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
la org.sonar.server.platform.web.CacheControlFilter.doFilter(CacheControlFilter.java:76)
la org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
la org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
la org.sonar.server.platform.web.SecurityServletFilter.doHttpFilter(SecurityServletFilter.java:76)
la org.sonar.server.platform.web.SecurityServletFilter.doFilter(SecurityServletFilter.java:48)
la org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
la org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
la org.sonar.server.platform.web.RedirectFilter.doFilter(RedirectFilter.java:58)
la org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
la org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
la org.sonar.server.platform.web.RequestIdFilter.doFilter(RequestIdFilter.java:66)
la org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
la org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
la org.sonar.server.platform.web.RootFilter.doFilter(RootFilter.java:62)
la org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
la org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
la org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)
la org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
la org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
la org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
la org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
la org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:544)
la org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)
la ch.qos.logback.access.tomcat.LogbackValve.invoke(LogbackValve.java:256)
la org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
la org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
la org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:364)
la org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:624)
la org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
la org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:831)
la org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1651)
la org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
la java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
la java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
la org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
la java.base/java.lang.Thread.run(Thread.java:829)
Am inspectat traficul SAML și acesta este ceea ce arată:
â¬â¹<samlp:AuthnRequest
AssertionConsumerServiceURL="https://ComapnyDomain.org/oauth2/callback/saml"
Destination="https://CompanyDomain.org/oauth2/callback/saml2"
ID="ONELOGIN_masked" IssueInstant="2022-03-09T08:45:23Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Versiune="2.0"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
saml:Issuerhttps://CompanyDomain.org</saml:Issuer><samlp:NameIDPolicy AllowCreate="true"
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/></samlp:AuthnRequest>
