vaulttec/sonar-auth-oidc

Unable to authentication using Sonarqube API Token after configuring OIDC Keycloak Authentication

Closed this issue · 3 comments

Akansha1804 commented

Hi, I have configured OIDC Authentication in my Sonarqube. I am successfully logging in using the Keycloak I configured. But now when I am trying to use the API token inside my pipelines, its not working.

I get this error all the times

ERROR: Error during SonarScanner execution
java.lang.NoClassDefFoundError: javax/servlet/Filter
	at java.base/java.lang.ClassLoader.defineClass1(Native Method)
	at java.base/java.lang.ClassLoader.defineClass(Unknown Source)
	at java.base/java.security.SecureClassLoader.defineClass(Unknown Source)
	at java.base/java.net.URLClassLoader.defineClass(Unknown Source)
	at java.base/java.net.URLClassLoader$1.run(Unknown Source)
	at java.base/java.net.URLClassLoader$1.run(Unknown Source)
	at java.base/java.security.AccessController.doPrivileged(Native Method)
	at java.base/java.net.URLClassLoader.findClass(Unknown Source)
	at org.sonarsource.scanner.api.internal.IsolatedClassloader.loadClass(IsolatedClassloader.java:82)
	at java.base/java.lang.ClassLoader.loadClass(Unknown Source)
	at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:84)
	at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:76)
	at org.sonar.classloader.DefaultClassloaderRef.loadClassIfPresent(DefaultClassloaderRef.java:40)
	at org.sonar.classloader.ClassRealm.loadClassFromParent(ClassRealm.java:147)
	at org.sonar.classloader.ParentFirstStrategy.loadClass(ParentFirstStrategy.java:35)
	at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:87)
	at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:76)
	at java.base/java.lang.ClassLoader.defineClass1(Native Method)
	at java.base/java.lang.ClassLoader.defineClass(Unknown Source)
	at java.base/java.security.SecureClassLoader.defineClass(Unknown Source)
	at java.base/java.net.URLClassLoader.defineClass(Unknown Source)
	at java.base/java.net.URLClassLoader$1.run(Unknown Source)
	at java.base/java.net.URLClassLoader$1.run(Unknown Source)
	at java.base/java.security.AccessController.doPrivileged(Native Method)
	at java.base/java.net.URLClassLoader.findClass(Unknown Source)
	at org.sonar.classloader.ClassRealm.loadClassFromSelf(ClassRealm.java:125)
	at org.sonar.classloader.ParentFirstStrategy.loadClass(ParentFirstStrategy.java:37)
	at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:87)
	at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:76)
	at org.vaulttec.sonarqube.auth.oidc.AuthOidcPlugin.define(AuthOidcPlugin.java:26)
	at org.sonar.scanner.bootstrap.ExtensionInstaller.install(ExtensionInstaller.java:60)
	at org.sonar.scanner.scan.ProjectScanContainer.addScannerExtensions(ProjectScanContainer.java:320)
	at org.sonar.scanner.scan.ProjectScanContainer.doBeforeStart(ProjectScanContainer.java:154)
	at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:135)
	at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
	at org.sonar.scanner.bootstrap.GlobalContainer.doAfterStart(GlobalContainer.java:150)
	at org.sonar.core.platform.ComponentContainer.startComponents(ComponentContainer.java:137)
	at org.sonar.core.platform.ComponentContainer.execute(ComponentContainer.java:123)
	at org.sonar.batch.bootstrapper.Batch.doExecute(Batch.java:72)
	at org.sonar.batch.bootstrapper.Batch.execute(Batch.java:66)
	at org.sonarsource.scanner.api.internal.batch.BatchIsolatedLauncher.execute(BatchIsolatedLauncher.java:46)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at org.sonarsource.scanner.api.internal.IsolatedLauncherProxy.invoke(IsolatedLauncherProxy.java:60)
	at com.sun.proxy.$Proxy0.execute(Unknown Source)
	at org.sonarsource.scanner.api.EmbeddedScanner.doExecute(EmbeddedScanner.java:189)
	at org.sonarsource.scanner.api.EmbeddedScanner.execute(EmbeddedScanner.java:138)
	at org.sonarsource.scanner.cli.Main.execute(Main.java:112)
	at org.sonarsource.scanner.cli.Main.execute(Main.java:75)
	at org.sonarsource.scanner.cli.Main.main(Main.java:61)
Caused by: java.lang.ClassNotFoundException: javax.servlet.Filter
	at java.base/java.net.URLClassLoader.findClass(Unknown Source)
	at org.sonarsource.scanner.api.internal.IsolatedClassloader.loadClass(IsolatedClassloader.java:82)
	at java.base/java.lang.ClassLoader.loadClass(Unknown Source)
	... 52 more

Do I need to perform some other modifications as well?

tjuerge commented

This issue is the same as reported on SO (but with a different SQ plugin).

It seems that the SQ scanner engine is trying to classload Java classes which are not inteded for client-side execution. This is because the class AutoLoginFilter (introduced in #44) misses the class annotation @ServerSide.

Ok, the missing annotation in this newly added class is my fault, but IMHO SQ's ExtensionInstaller has it's own issues: It knows all the other plugin classes which are properly annotated with @ServerSide and should come to the conclusion that this plugin is not intended for server-side execution.

So unluckily this plugin version is not usable :-( You can use the previous version of this plugin or wait for the hotfix.

Akansha1804 commented

Hello @tjuerge, Thank you for your reply.

Canyou suggest a version which can work for me? I want to access Sonarqube using my CI/CD pipeline, and I really need the SQ API token to work in my pipelines

tjuerge commented

Can you suggest a version which can work for me?

The previous one should do the job.

  • 👍1