Hi, some question here

1. I see that octane plugin is 6.1 - what is the FOD plugin ver ?
2. Is the pipeline set to be type 'security' ?
3. Are the vulnerabilities that were found have later date (introduce date) than the pipeline creation ? (vulnerabilities that exist before the pipeline creation wont be injected)
4. Is it possible to submit jenkins log ? found in:  <Jenkins url>/userContent/nga/logs/nga.log
5. Also, please tell me if u'r jenkins job is a simple one or pipeline as a code ?

Thanx

Nir

Thanks Nir,

1. FOD Plugin version 5.0.1
2. Pipeline is "End to End" and "Security" - can it be more than one tag?
3. Yes vulnerabilities found in commit to repository (see attached) after pipeline was created.
4. Attached
5. It is Jenkinsfile Pipeline in GitHub - commit to repository starts Jenkins/Octane Pipeline and FOD upload!

It is for customer demo. I can leave VM up for a while if you want to look (pm for login details: kevin.lee@microfocus.com)

Kevin

Tried running the same build in a Freestyle Jenkins Job (set Octane Pipeline to Security only) - now there is Authentication error in log (see nga2.log). Don't know why this is the case as the Pipeline uploads and runs the Scan in FOD successfully?

I have tried both API Key and Personal Access Token authentication with the same result.

Kevin

Hi Kevin,

it seems according to the error that octane plugin having hard times connecting to FOD.

in jenkins configuration - did u update correctly the fortify on demand section ?  (url , API url, api key and secret) - is the test connection button working for you ? (see example below)

Yes, i have tried both API Key and PAT - clicking on "Test Connection" works. I notice your screenshot is slightly different as "Secret" does not use Jenkins Credentials - does this make any difference?

It looks like this does not work with the latest version of FOD Uploader plugin (5.0.1) where they switched to using Jenkins Credentials plugin for Secrets rather than plain text field. I added a bit of debugging to FODConnector.java:

INFO [VulnerabilitiesPushWorker-58 ] FODConnector : grant_type=client_credentials&scope=api-tenant&client_id=852dae7d-2280-4d76-8e2e-9f8fc0bee63c&client_secret=fod-api-key

For the client_secret it is use the Credentials id "fod-api-key" rather than resolving its actual value.

This version of FOD is not supported yet.

Integration of ALM Octane and Fortify on Demand is still not possible - this is preventing adoption of Octane and FOD!!!

Similar (same?) issue occurring.

Fortify scan is triggered, and runs to completion, but no Vulnerabilities are loaded into Octane.

• Jenkins LTS 2.303.1 on Kubernetes
• Micro Focus Application Automation Tools plugin 7.0
• Fortify on Demand plugin 6.1.0
• Octane 16.0.116.45
  • API permissions verified
• Fortify permissions verified

Relevant nga.log below:

{{ 01/10/2021 17:15:21,111 ERROR [VulnerabilitiesPushWorker-92 ] VulnerabilitiesServiceImpl : https://OCTANE_SERVER?p=142001 permanent error on 'JOB_NAME #9', passing over
com.hp.octane.integrations.exceptions.PermanentException: Cannot authenticate:Not Found
at com.hp.octane.integrations.services.vulnerabilities.fod.dto.FODConnector.getAccessToken(FODConnector.java:213) ~[integrations-sdk-2.7.0.18.jar:?]
at com.hp.octane.integrations.services.vulnerabilities.fod.dto.FODConnector.initConnection(FODConnector.java:80) ~[integrations-sdk-2.7.0.18.jar:?]
at com.hp.octane.integrations.services.vulnerabilities.fod.dto.FodConnectionFactory.createFodConnector(FodConnectionFactory.java:75) ~[integrations-sdk-2.7.0.18.jar:?]
at com.hp.octane.integrations.services.vulnerabilities.fod.dto.FodConnectionFactory.instance(FodConnectionFactory.java:39) ~[integrations-sdk-2.7.0.18.jar:?]
at com.hp.octane.integrations.services.vulnerabilities.fod.dto.services.FODReleaseService.getScansLastInFirstFetched(FODReleaseService.java:36) ~[integrations-sdk-2.7.0.18.jar:?]
at com.hp.octane.integrations.services.vulnerabilities.fod.FODServiceImpl.fodScanIsStillInProgress(FODServiceImpl.java:109) ~[integrations-sdk-2.7.0.18.jar:?]
at com.hp.octane.integrations.services.vulnerabilities.fod.FODServiceImpl.getVulnerabilitiesScanResultStream(FODServiceImpl.java:71) ~[integrations-sdk-2.7.0.18.jar:?]
at com.hp.octane.integrations.services.vulnerabilities.VulnerabilitiesServiceImpl.processPushVulnerabilitiesQueueItem(VulnerabilitiesServiceImpl.java:231) ~[integrations-sdk-2.7.0.18.jar:?]
at com.hp.octane.integrations.services.vulnerabilities.VulnerabilitiesServiceImpl.worker(VulnerabilitiesServiceImpl.java:172) ~[integrations-sdk-2.7.0.18.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) [?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) [?:?]
at java.lang.Thread.run(Thread.java:829) [?:?]
01/10/2021 17:15:22,015 INFO [BuildLogsPushWorker-89 ] LogsServiceImpl : https://OCTANE_SERVER?p=142001 successfully pushed log of 'JOB_NAME #9', root job : JOB_NAME to WS 1002, correlation Id = 29ba96ee3ea4405c96ed3917d
}}