Let’s connect your GitLab integration! Data Theorem’s SAST can connect to GitLab.com, GitLab On-Prem, and GitLab Ultimate.
Onboarding your GitLab instance will require communication with Data Theorem. This page will guide you through the how to configure your GitLab Self-Managed instance to use Data Theorem’s SAST scanning without sharing your code with Data Theorem. It will create AWS resources to run a container-based SAST scanner provided by Data Theorem. The SAST scan results will be visible in the Data Theorem portal
Please reach out to support@datatheorem.com if you need help!
| Table of Contents | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Onboard GitLab (Cloud)
Note that the onboarding user must be an admin within your GitLab workspace.
Navigate to gitLab.com.
Select
Groupsand select the group that you would like to connect to Data Theorem's SAST analyzer.
Select
Settings, thenApplications.
Select
Add new application.
Configure the application using the following options:
Name:
Data Theorem SASTTrusted: Not required
Redirect URI:
https://www.securetheorem.com/gitlab-integration/onboardingConfidential: checked
Scoped:
apiandread_repository
Select
Save Application
Send the URL, the
Application ID, and theSecretto your Data Theorem contact. These are the credentials that the Data Theorem SAST Analyzer will use to connect to your GitLab instance.
...
Important: Click the link in the email, then click
Authorize.
Your GitLab Ultimate instance has been successfully onboarded! Your source code will now continuously be scanned for security and privacy issues, which can be found on https://www.securetheorem.com/mobile-secure/v2/security/sast?view=issues or directly in your GitLab Ultimate merge requests.
Onboard GitLab (Self-Managed)
Installation
Requirements
The GitLab installation must be exposed to the internet
The user following these instructions must have administrator permissions to the GitLab instance
AWS Account with Admin Access
...
Step 1: Create A Data Theorem App In GitLab
Start with creating the GitLab application for the Data Theorem integration:
Log into the GitLab instance
Open “Applications” in the Admin Area
Create a new instance-wide application with the following settings
Name:
Data Theorem SASTTrusted: Not requiredRedirect URI:
https://www.securetheorem.com/gitlab-integration/onboardingTrusted: checked
Confidential: checked
ScopedScopes:
apiandread_repository
...
...
The application settings should look like this:
...
| Info |
|---|
We will update the “Redirect URI” value to the the URI of our AWS Lambda handler in a later step. We use this value a secure placeholder, but OAuth redirects will not be sent to this URI. |
Clicking “Save application”
Securely make a note of the Application ID, Secret, and instance URL (from the address bar of your browser)
Deploy AWS Resources
Paste the values for the GitLab App Id, Gitlab App Secret
...
. You will need to enter these values in the next step
...
Step 2: Create AWS Resources
Open the AWS CloudFormation Quick Create Link you received from Data Theorem, and sign in the AWS account where you want the SAST scanning resources to be created.
Fill in the following template parameters:
GitLabInstanceUrl: Enter the URL of your GitLab instance
GitLabAppClientId: Enter”Application ID” from Step 1
GitLabAppClientSecret: Enter the “Secret” from Step 1
...
Step 3: Configuring The GitLab System Hook
The system hook will notify the GitLab integration of changes to any of the repositories present in the GitLab integration.Once the Data Theorem SAST application has been created in the GitLab instance. You should have received an email titled “GitLab hook authorization token”. Please reach out to the Data Theorem support team if you haven’t received this email.
Configuration steps:
Log into the GitLab instance
Open Navigate to “System Hooks” in the Admin Area
Create a new system hook with the following settings:
URL: Past the value of the CloudFormation Template Copy/Paste the CloudFormation Stack Output named
GitLabSystemHookUrlSecret Token: Copy and paste the code from the email/Paste the CloudFormation Stack Output named
GitLabSystemHookSecretTrigger:
Check “Repository update events”
Check “Merge request events”
Check “SSL verification”
The system hook should look like this:
...
Step 4: Update The GitLab App OAuth Redirect URI
Open “Applications” in the Admin Area
Edit the Data Theorem SAST application and update the Redirect URI setting
Redirect URI: Copy/Paste the CloudFormation Stack Output named
GitLabOAuthRedirectUri
