Using ZAP Docker Image in CI/CD Pipeline for Microservices with OAuth Authentication
Shubham Bhingarde
I'm working on a large-scale microservices project with over 190 services. I've recently integrated DevSecOps into our workflow, and as part of this, I've set up a DAST stage in our CI/CD pipeline using the ZAP Docker image to perform a full scan.
Each time a new build is triggered in Jenkins, I need to ensure that DAST is run across all these microservices. However, our services are secured by an OAuth service, requiring authentication before accessing any service URL. This redirection to the OAuth service is mandatory, and I already have the necessary credentials for authentication.
My question is: How can I configure ZAP to seamlessly pass through the OAuth service and perform a full scan on all our service URLs during the Jenkins build? Are there specific flags or configurations within the ZAP Docker image that would allow me to pass the OAuth credentials directly?
Any guidance or suggestions would be greatly appreciated!
Shubham Bhingarde
truclb
agent any
parameters {
string(
defaultValue: '<url_for_scan>',
description: 'Target URL to scan',
name: 'TARGET'
)
booleanParam(
defaultValue: true,
description: 'Parameter to know if you want to generate a report.',
name: 'GENERATE_REPORT'
)
}
stages {
stage('Setting up ZAP docker container') {
steps {
echo 'Starting container --> Start'
sh 'docker run -dt --name zapscan zaproxy/zap-stable /bin/bash'
echo 'Starting container --> End'
}
}
stage('Prepare wrk directory') {
when {
environment name: 'GENERATE_REPORT', value: 'true'
}
steps {
script {
// Create a Folder /zap/wrk then copy context file to Folder.
sh '''
docker exec zapscan \
mkdir -p /zap/wrk
docker cp ${WORKSPACE}/<context file> zapscan:/path/to/<context file>
'''
}
}
}
stage('Scanning target on ZAP container - FULL SCAN') {
steps {
script {
sh """
docker exec zapscan \
zap-full-scan.py \
-t $target \
-n ./<context file> \
-U <name of user> \
-r ./report.html \
-I
"""
}
}
}
stage('Copy Report to Workspace') {
steps {
script {
sh '''
echo Workspace la: ${WORKSPACE}
docker cp zapscan:/zap/wrk/report.html ${WORKSPACE}/report.html
'''
}
}
}
post {
always {
echo 'Removing container'
sh '''
docker stop zapscan
docker rm zapscan
'''
cleanWs() //clean workspace after using
}
}
}
}
