DEYS0013 (Community Member) asked a question.
I'm trying to add a dynamic analysis with AUTO authentication from the rest API but it is not enabled.
I'm using the REST API "analyses/{analysis_id}/scans" to add a dynamic scan with AUTO authentication. The username and password are populated on the website but the "Authentication Required" value is false. How do I set that to "required" from the API?
Thank you,
Paul
.png){kind=logo}
Hello @DEYS0013 (Community Member)
,
Thank you for reaching out to the Community.
There is some information on different types of authentication you can use with Dynamic Analysis.
I have provided a link to the help center that will help you.
https://docs.veracode.com/r/t_dynamic_logins
We would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.
Kind regards,
Steven
Veracode Support Engineer
Steven,
This was the resource I used to create the code for the API request. The code does not seem to work as advertised. I have opened a case with Veracode to investigate this issue.
Thank you,
Paul
@DEYS0013 (Community Member) Not sure if you managed to get an answer to this problem, but I stumbled across the answer while creating a Dynamic Scan manually (DevTools can be used for good as well as evil :-))
It looks like the "auth_configuration" details now need to be a part of the "scan_config_request". I have successfully created an authenticated scan using the [obfuscated] payload structure below. I am using the Internal Scanning tools ["internal_scan_configuration"] which you may or may not need.
To make this work you will need to replace:-
ENDPOINT_ID with your ISE Endpoint Id
GATEWAY_ID with your ISE Gateway ID
LINKED_APP_ID with the UUID for your application
TARGET_URL with the URL of the application to be tested
USERNAME & PASSWORD with the relevant username and password 🙂
Good luck
Duncan
{
"name": "MyAuthenticatedDastScan",
"scans": [
{
"internal_scan_configuration": {
"enabled": true,
"endpoint_id": "ENDPOINT_ID",
"gateway_id": "GATEWAY_ID"
},
"linked_platform_app_uuid": "LINKED_APP_ID",
"scan_config_request": {
"target_url": {
"url": "TARGET_URL",
"http_and_https": true,
"directory_restriction_type": "DIRECTORY_AND_SUBDIRECTORY"
},
"auth_configuration": {
"authentications": {
"AUTO": {
"authtype": "AUTO",
"username": "USERNAME",
"password": "PASSWORD"
}
}
}
}
}
],
"schedule": {
"now": true,
"duration": {
"length": 1,
"unit": "DAY"
}
}
}
This still seems to be an issue 2 months later. Surely this needs a solution - either documentation updates or a code change to make the payload in the documentation viable.
I too have raised a support ticket as all of the applications I am trying to scan require a login.