Sonar-dotnet: SonarQube - TFS 2018 integration - Prepare analysis task failing with error (401) Unauthorized

[marcusvnac]

Description

I am trying to use SonarQube (server version 7.3) with TFS 2018, however, the first task (SonarQube - Prepare analysis) is always failing with a 401 error. I am using the connector available at the Marketplace and also I followed all the available instructions.

If I call same SonarQube URL direct from outside TFS the using the same Token as configured I can get the JSON file that the SonarQube server returns, so I am thinking that this task is maybe using a wrong auth schema.

I made a test adding the parameters sonar.login and sonar.password in the Advanced -> Additional Properties, and this way it worked. However, the error was moved to the "Publish Quality Gate Result" task. It seems that is something with the TFS SonarQube service that is in the Marketplace.

Repro steps

Just installed SonarQube Server, SonarQube TFS extension and try to connect them.

Expected behavior

TFS Build connects to SonarQube and runs the analysis.

Actual behavior

Error: The remote server returned an error: (401) Unauthorized.

Known workarounds

I found that if a put the properties sonar.login and sonar.password in the Advanced -> Additional Properties it works for this task but it will fail in the next ( "Publish Quality Gate Result")

Related information

• TFS on-premises: TFS 2018 (Version 16.131.27701.1)
• TFS Build Agent - Private:
  
  
  
  • Agent.OS | Windows_NT
  
  
  • Agent.OSVersion | 10.0.14393
  
  
  • Agent.Version | 2.120.2
  
  
• SonarQube Server version: 7.3

Error logs

2018-08-16T21:10:40.5523637Z ##[section]Starting: SonarQube - Prepare analysis
2018-08-16T21:10:40.5523637Z ==============================================================================
2018-08-16T21:10:40.5523637Z Task : Prepare Analysis Configuration
2018-08-16T21:10:40.5523637Z Description : Prepare SonarQube analysis configuration
2018-08-16T21:10:40.5523637Z Version : 4.3.2
2018-08-16T21:10:40.5523637Z Author : sonarsource
2018-08-16T21:10:40.5523637Z Help : More Information
2018-08-16T21:10:40.5523637Z ==============================================================================
2018-08-16T21:10:41.1773864Z SYSTEMVSSCONNECTION exists true
2018-08-16T21:10:41.2398894Z [command]C:\Builds_work_tasks\SonarQubePrepare_15b84ca1-b62f-4a2a-a403-89b77a063157\4.3.2\classic-sonar-scanner-msbuild\SonarScanner.MSBuild.exe begin /k:$MYKEY
2018-08-16T21:10:41.2867651Z SonarScanner for MSBuild 4.3.1
2018-08-16T21:10:41.2867651Z Using the .NET Framework version of the Scanner for MSBuild
2018-08-16T21:10:41.3336432Z Default properties file was found at C:\Builds_work_tasks\SonarQubePrepare_15b84ca1-b62f-4a2a-a403-89b77a063157\4.3.2\classic-sonar-scanner-msbuild\SonarQube.Analysis.xml
2018-08-16T21:10:41.3336432Z Loading analysis properties from C:\Builds_work_tasks\SonarQubePrepare_15b84ca1-b62f-4a2a-a403-89b77a063157\4.3.2\classic-sonar-scanner-msbuild\SonarQube.Analysis.xml
2018-08-16T21:10:41.3336432Z Pre-processing started.
2018-08-16T21:10:41.3336432Z Preparing working directories...
2018-08-16T21:10:41.3805197Z 15:10:41.38 Updating build integration targets...
2018-08-16T21:10:41.3961459Z 15:10:41.396 Fetching analysis configuration settings...
2018-08-16T21:10:41.4273969Z ##[error]15:10:41.427 Failed to request and parse '$SERVER_URL_HIDDEN/api/settings/values?component=$MYKEY': The remote server returned an error: (401) Unauthorized.
2018-08-16T21:10:41.4273969Z 15:10:41.427 Failed to request and parse '$SERVER_URL_HIDDEN/api/settings/values?component=$MYKEY': The remote server returned an error: (401) Unauthorized.
2018-08-16T21:10:41.4273969Z ##[error]15:10:41.427 Could not authorize while connecting to the SonarQube server. Check your credentials and try again.
2018-08-16T21:10:41.4273969Z 15:10:41.427 Could not authorize while connecting to the SonarQube server. Check your credentials and try again.
2018-08-16T21:10:41.4273969Z ##[error]15:10:41.427 Pre-processing failed. Exit code: 1
2018-08-16T21:10:41.4273969Z 15:10:41.427 Pre-processing failed. Exit code: 1
2018-08-16T21:10:41.4430235Z ##[error]C:\Builds_work_tasks\SonarQubePrepare_15b84ca1-b62f-4a2a-a403-89b77a063157\4.3.2\classic-sonar-scanner-msbuild\SonarScanner.MSBuild.exe failed with return code: 1
2018-08-16T21:10:41.4430235Z ##[section]Finishing: SonarQube - Prepare analysis

2018-08-16T21:58:39.3075540Z ##[section]Starting: SonarQube - Publish Quality Gate Result
2018-08-16T21:58:39.3075540Z ==============================================================================
2018-08-16T21:58:39.3075540Z Task : Publish Quality Gate Result
2018-08-16T21:58:39.3075540Z Description : Publish SonarQube's Quality Gate result on the VSTS/TFS build result, to be used after the actual analysis.
2018-08-16T21:58:39.3075540Z Version : 4.3.0
2018-08-16T21:58:39.3075540Z Author : sonarsource
2018-08-16T21:58:39.3075540Z Help : More Information
2018-08-16T21:58:39.3075540Z ==============================================================================
2018-08-16T21:58:40.0888268Z ##[error][SQ] Could not fetch metrics
2018-08-16T21:58:40.0888268Z ##[error][SQ] API GET '/api/metrics/search' failed, status code was: 401
2018-08-16T21:58:43.0732984Z ##[error][SQ] API GET '/api/ce/task' failed, status code was: 401
2018-08-16T21:58:43.0732984Z ##[error][SQ] Could not fetch task for ID 'AWVEv14'
2018-08-16T21:58:43.0889233Z ##[section]Finishing: SonarQube - Publish Quality Gate Result

[henryju]

When configuring your endpoint, you have to provide a token, that you should have generated in the SonarQube UI. Is this token still valid?
You say it works when passing manually the properties sonar.login and sonar.password. If your token is valid, it should also work by simply passing sonar.login= (please check).
Last thing to check: is your SonarQube server using the standard authentication, or are you using any kind of SSO?

[marcusvnac]

Hi.

The token is configured correctly in the endpoint. I can test the same call
using Postman, for instance, passing the token as user with Basic
authentication as is in the SonarQube docs, and it works.

The server has SSO with Azure AD, using the AAD plugin.

On Wed, Aug 29, 2018, 4:09 AM Julien HENRY, [e-mail]
wrote:

When configuring your endpoint, you have to provide a token, that you
should have generated in the SonarQube UI. Is this token still valid?
You say it works when passing manually the properties sonar.login and
sonar.password. If your token is valid, it should also work by simply
passing sonar.login= (please check).
Last thing to check: is your SonarQube server using the standard
authentication, or are you using any kind of SSO?

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/SonarSource/sonar-csharp/issues/1716#issuecomment-416900097,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AHLyKhkR_YCp8LLKwKvM05Y-xKpgN18Vks5uVmh2gaJpZM4WBvC_
.

[Evangelink]

Hi @marcusvnac,

Are you still experiencing those issues?

[marcusvnac]

Hi @Evangelink ,

Yes, I wasn't able to fix it yet.

[marcusvnac]

I disabled the SSO with Azure AD, using the AAD plugin, and the problem still happens...

[marcusvnac]

Hey @Evangelink ,

We run Fiddler on the Build Server and see what was going on with the requests being made. By changing the auth schema to Bearer, using the same grabbed token, I could get a HTTP 200s. Can this be a bug within this TFS Connector?

As there is no way to force the plugin to authenticate using Beare instead of Basic, we are still with this without running. I'm looking forward to some help here because we're are running out of ideas about what can be the problem.

Sonme Tech Details:

GET {SERVERURL} HTTP/1.1
Authorization: Basic {basictoken}
User-Agent: ScannerMSBuild/4.3.1
Host: {SERVERURL}

HTTP/1.1 401
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Powered-By: ARR/3.0
Date: Wed, 10 Oct 2018 20:47:27 GMT
Content-Length: 0

--Simply switching from Basic to Bearer

GET {SERVERURL} HTTP/1.1
Authorization: Bearer {bearertoken}
User-Agent: ScannerMSBuild/4.3.1
Host: {SERVERURL}

HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: application/json
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Sonar-Version: 7.3.0.15553
X-Powered-By: ARR/3.0
Date: Wed, 10 Oct 2018 20:47:56 GMT
Content-Length: 6904

[henryju]

Wait, what kind of token are you configuring in the SonarQube endpoint? Are you using an oauth token generated from Azure AD? Or a SonarQube token, generated from the user security page?

[marcusvnac]

Hey @henryju, I'm using the SonarQube token

I disabled the AAD integration while this issue is not solved.

[julienlancelot]

Hello @marcusvnac, are you using a Proxy ?

[marcusvnac]

Hey @julienlancelot , we don't use proxies here.

[marcusvnac]

Hey, as the problem is still going on even after updating the server to the new 7.4 version, I changed my build pipeline to call Sonar Qube via command line (using the same Token to auth). This way I can submit my analysis to the server, however without using the SonarQube tasks. It is a workaround while this mystery is solved.

[giddyelysium]

Is there any further analysis going to happen on this one? I have the same issue and using the same workaround on TFS with the advanced properties for login and password as using token returns 401 errors and is not seen as an active user and using login/password combo results in the Publish Quality Gate Result task failing?

[Evangelink]

Moved to community forum.

[henryju]

@marcusvnac I think I have an idea about this problem. Are you following the community thread created by @Evangelink ?

[marcusvnac]

Hey @henryju , I am just following here. I wasn't aware of the community thread, I'll follow them now. Thank you for the update.

[attiqmscs004]

@marcusvnac
Hi I have faced the same issue. I am not sure about the behaviour but this is how you can fix the problem atleast i have

Example prepare step - working:

• task: SonarQubePrepare@4
  inputs:
  SonarQube: "MySonarQube"
  scannerMode: "CLI"
  configMode: "file"
  extraProperties: |
  sonar.verbose=true
  sonar.login=login
  sonar.password=password
  sonar.projectKey=projectKey
  sonar.projectName=projectToken
  sonar.sources=path of your application source code

[Lalit-1219]

read everything except the solution...

[andrei-epure-sonarsource]

hi @Lalit-1219 , if you need some help please open a thread on https://community.sonarsource.com/c/help/8