OWASP Dependency Tracker - Jenkins build error

Viewed 1241

I am Getting 403 Forbidden error while testing OWASP Dependency Tracker integration with Jenkins build.

[DependencyTrack] Publishing artifact to Dependency-Track - http://localhost:8080
[DependencyTrack] The artifact was successfully published - 9812e933-6bc1-4453-951f-9a75a7d693d4
[DependencyTrack] Polling Dependency-Track for BOM processing status
[DependencyTrack] Processing findings
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline

org.jenkinsci.plugins.DependencyTrack.ApiClientException: An error occurred while retrieving findings - HTTP response code: 403 Forbidden
    at org.jenkinsci.plugins.DependencyTrack.ApiClient.getFindings(ApiClient.java:95)
Caused: org.jenkinsci.plugins.DependencyTrack.ApiClientException: An error occurred while retrieving findings
    at org.jenkinsci.plugins.DependencyTrack.ApiClient.getFindings(ApiClient.java:98)
    at org.jenkinsci.plugins.DependencyTrack.DependencyTrackPublisher.perform(DependencyTrackPublisher.java:230)
    at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:80)
    at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:67)
    at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:834)
Finished: FAILURE

Jenkinsfile

pipeline {
    agent any
    stages {
        stage ('Build') {
            steps {
                sh 'mvn clean package'
            }
        }
        stage ('Generate BOM') {
            steps {
                sh 'mvn org.cyclonedx:cyclonedx-maven-plugin:makeBom'
            }
        }
        stage ('Dependency Tracker') {
            steps {
                dependencyTrackPublisher artifact: 'target/bom.xml', projectId: '9812e933-6bc1-4453-951f-9a75a7d693d4', synchronous: true
            }
        }
    }
}

Dependency tracker Jenkins plugin is configured properly with ApiKey enter image description here

Did I miss any other configuration? Please suggest.

1 Answers

I was able to resolve the issue by assigning VULNERABILITY_ANALYSIS permission to the token used by Jenkins

Tokens and their permissions can be accessed using Administration -> Access Management -> Teams menu option

Related