Add and enable Rut Auth capability using scripting API

post by faizan.ahmad55 on Oct 12, 2018

Hello

I’m trying to add Rut Auth capability and enable Rut Auth realm using scripting API. But I haven’t found anything useful yet. The documentation examples are for repositories. Is there any way to add Rut Auth capability and enable Rut Auth realm using scripting API? Or we have to add it manually from UI?

Any help would be much appreciated.

post by rseddon on Oct 12, 2018

Have a look here: nexus3-oss/setup_realms.groovy at master · ansible-ThoTeam/nexus3-oss · GitHub

post by mworthington on Oct 12, 2018

Continuing the discussion from Advanced Use Cases for the Nexus Repository Manager API:

In addition to what @rseddon mentioned, you may also need to create and configure a Nexus Capability so that Nexus knows which HTTP header to look at for the authenticated user name.

More about RUT Auth can be found in the docs at Authentication via Remote User Token. And, not directly related, but architecturally the same, this guide provides context around Remote User Token Authentication: PKI Authentication for Nexus - Sonatype Guides

A sample groovy script to create and configure the capability, which will also automatically enable the realm:

import groovy.json.JsonOutput
import org.sonatype.nexus.capability.CapabilityReference
import org.sonatype.nexus.capability.CapabilityType
import org.sonatype.nexus.internal.capability.DefaultCapabilityReference
import org.sonatype.nexus.internal.capability.DefaultCapabilityRegistry

returnValue = JsonOutput.toJson([result : 'Did NOT add Rut Auth'])

def capabilityRegistry = container.lookup(DefaultCapabilityRegistry.class.getName())

//Capability specific values/properties
def capabilityType = CapabilityType.capabilityType("rutauth")
def capabilityProps = ['httpHeader': 'some_auth_header']
def capabilityNotes = 'configured through scripting api'

//check if existing Rut Auth capability exists
DefaultCapabilityReference existing = capabilityRegistry.all.find { CapabilityReference capabilityReference ->
  capabilityReference.context().descriptor().type() == capabilityType
}

//If it doesn't, add it with given values/properties
//This should also enable the rutauth-realm
if (!existing)
{
  log.info('Rut Auth capability created as: {}',
           capabilityRegistry.add(capabilityType, true, capabilityNotes, capabilityProps).toString())

returnValue = JsonOutput.toJson([result : 'Successfully added Rut Auth!'])
}

return returnValue

post by faizan.ahmad55 on Oct 12, 2018

Thank you @mworthington and @rseddon. This helped me a lot.

post by deven.phillips on Mar 13, 2019

“Simple” being a relative term here. The scripting capability in Nexus is not very conducive for infrastructure-as-code; so if you are trying to completely rebuild your environment using tools like Ansible or Puppet it’s really quite painful.

post by cedrico2015 on Jul 17, 2019

Thank you very much for this interesting snippet.

However I have a trivial question.

This line: “def capabilityRegistry = container.lookup(DefaultCapabilityRegistry.class.getName())”

Where is the value from “container” set? you access the container object and it has not been defined before.

post by mpiggott on Jul 17, 2019

The system provides it, the scripts don’t need to define it.

post by jonathan.derham on Feb 19, 2020

In the above example, the capabilityType "rutauth’ is used. If we want to automate the creation of other types of Capabilities, where do we find information/doco on what ID we should use for the other Capabilities?

I need to create an ‘IQ: Audit and Quarantine’ capability. Where do I find information on what ID I should use, and what properties I should set?

post by dbradicich on Jul 9, 2020

Hopefully you had received an answer to this by now, but in case not (and for others future ref), the typeId is firewall.audit and the properties you can set are repository (use desired repositoryId) and quarantine (true/false)