Add ability for Maven Plugin to create an application in a given organization

csmith · October 15, 2019, 3:30pm

I have a case where our NXIQ is broken into multiple Orgs under the Root. These orgs have different requirements and therefore policy levels, so we have slightly different policies on each org. We have new applications spring up with some regularity and so have configured the “Auto-create application” option in the server.

Unfortunately, this means that we need to upload all new applications to a common org as a “dumping ground” with a lowest-common denominator policy before manually transferring them to the correct org (and the correct policy). This means that the initial upload goes to the wrong org with potentially the wrong policy.

My ask is to allow the maven plugin to be configured to have an Org or OrgID passed in and the plugin will create the application in the correct org (if it doesn’t exist) and then scan against the correct org’s policy. Without this, we can’t put our apps into a blocking mode as the first scan is always non-blocking, but subsequent ones may be and we have to frequently check in with NXIQ to see new applications.

I will lay odds that this change may also require that an api user that is set up for scanning apps in a CI/CD pipeline would need the Create Apps permission, or you would need to move the “Auto-create” switch into a role, rather than a global configuration.

jwhitehouse · October 16, 2019, 7:18pm

Thanks for the input Chris. I understand how this can be painful, and solving it is within our vision. At this time it’s out of scope for our 2019 roadmap.

ctolo · October 17, 2019, 4:13pm

The IQ server API can test if an application is not already loaded and add it to the organization of your choosing. You would need to run a script before you scan with the Maven plugin but should solve your issue. Here is an example you could work from.

github.com

ctolo/iq-add-applications/blob/master/iq_add_application.py

import requests
import argparse

iq_session = requests.Session()
iq_url = ""

def main():
	global iq_url
	parser = argparse.ArgumentParser(description='Add Applications to IQ')
	parser.add_argument('-a','--auth', default="admin:admin123", required=False)
	parser.add_argument('-u','--url', default="http://localhost:8070", required=False)
	parser.add_argument('-i','--publicId', required=True)
	parser.add_argument('-n','--name', default="", required=False)
	parser.add_argument('-o','--orgName', default="Sandbox Organization", required=False)


	args = vars(parser.parse_args())
	creds = args["auth"].split(":")
	iq_session.auth = requests.auth.HTTPBasicAuth(creds[0], creds[1] )
	iq_url = args["url"]

This file has been truncated. show original

csmith · October 17, 2019, 5:26pm

Thanks both. I hope that Sonatype considers this in the future as it makes the CI/CD process a bunch cleaner.

Chris, thanks for the snippet. We built something similar for our case, though it does feel like a hack to make up for an incomplete automation process. I really appreciate you taking the time to make and send this.