在 Jenkins 中访问 Blackduck REST API 的 SAML 身份验证答案

【问题标题】：SAML Authentication accessing Blackduck REST API in Jenkins在 Jenkins 中访问 Blackduck REST API 的 SAML 身份验证
【发布时间】：2020-05-07 08:08:07
【问题描述】：

我正在尝试从 Jenkins 声明式管道调用 Blackduck REST API 因为 blackduck 首先使用 login.microsoftonline.com 中的 SAML 进行身份验证，然后提交请求并提供响应。如果使用浏览器访问https://blackduckxxx.com/api/projects?q=name:myproject，它会首先要求登录我的 SSO（用户名和密码），然后重定向以显示 API 结果。此处也使用 API 令牌。

如果我尝试从 Jenkins 管道访问相同的 API，我会得到以下响应

   <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
    <head>
        </head>
    <body onload="document.forms[0].submit()">
        <noscript>
            <p>
                <strong>Note:</strong> Since your browser does not support JavaScript,
                you must press the Continue button once to proceed.
            </p>
        </noscript>

        <form action="https&#x3a;&#x2f;&#x2f;login.microsoftonline.com&#x2f;222fcaf7-15d0-455f-97e1-8fda2eaad539&#x2f;saml2" method="post">
            <div>

                <input type="hidden" name="SAMLRequest" value=".............."/>                

            </div>
            <noscript>
                <div>
                    <input type="submit" value="Continue"/>
                </div>
            </noscript>
        </form>
            </body>
</html>

尝试在url等中传递用户名和密码

    https://blackduckxxx.com/api/projects?q=name:myprojects&user=me&password=mypwd

However it did not work.

```` Jenkins pipeline

    stage("OC login"){
            steps{
                script{
                def bdUrl = 'https://blackduckxxx.com'
                def bdApi = '/api/projects' 
                def params = 'name:myproject'
                def bdUrlRequestProjectID = bdUrl + bdApi + "?q=" + params
                 println("bdUrlRequestProjectID is ${bdUrlRequestProjectID}")

                def response = httpRequest authentication: 'login-microsoft', acceptType: 'APPLICATION_JSON',httpMode: 'GET',consoleLogResponseBody: true, url: "${bdUrlRequestProjectID}", customHeaders: [[name: 'X-CSRF-TOKEN', value: 'xxxxxx']] 



                }
            }

        }
    }
    }

预期结果是从 Blackduck API 获取项目名称标准响应

【问题讨论】：

你有没有让这个工作？

标签： jenkins jenkins-pipeline httprequest saml-2.0

【解决方案1】：

这是通过使用不记名令牌和 curl 命令解决的参考下面

 def bearerToken
        script.withCredentials([script.usernamePassword(credentialsId: "blackDuckAuthentication", usernameVariable: 'username', passwordVariable: 'bdToken')]) {
            def json_BearerToken = script.sh(script: "curl -s -X POST -H 'Authorization: token ${script.bdToken}' -H 'cache-control: no-cache' 'https://blackduckxxx.com/api/tokens/authenticate'", returnStdout: true)
            bearerToken = new JsonSlurperClassic().parseText(json_BearerToken).get("bearerToken").trim()
 def json_Projects = script.sh(script: "curl -X GET -H 'Accept: application/json' -H 'Authorization: Bearer ${bearerToken}' 'https://blackduckxxx.com/api/projects'", returnStdout: true)

【讨论】：