Authentication issues -- API key is not working

[lwoodring]

I have been using this tool for quite some time & it has been very helpful.

I just started having issues with Authentication though. I specify an API key to the NVD database, in Maven:
<nvdApiKey>#######</nvdApiKey>

I am using the current release: 12.1.5
and receiving this error:

One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during analysis:
[ERROR] InitializationException: Error initializing OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required

1. Thinking that maybe my API key had expired (I don't know if there is an expiration, they don't seem to mention it),
   I generated a new one at: https://nvd.nist.gov/developers/request-an-api-key
   but received the same error message.

2. The error message itself points to a different URL than the NVD one (sonatype) for generating an API key, so I also registered an account & created an API key there. Same error message.

3. I also tried just using the username/password from OSS/Sonatype registration (just these lines & also w/nvdApiKey):

<nvdUser>aaaaa</nvdUser>
<nvdPassword>bbbbbbbbbbb</nvdPassword>

also received the same error message.

Would you please point me in the right direction to solve this? Which place should I be using to generate an API key?
Thanks!

[marcelstoer]

NVD != OSS Index

What you need is ossIndexUsername and a matching password.

→ https://dependency-check.github.io/DependencyCheck/analyzers/oss-index-analyzer.html

(you might also want to bump to 12.1.6)

[lwoodring]

I realize that they are different -- but when using just <nvdApiKey> (which I have always done), I was receiving an error that pointed to an OSSIndex url (kinda misleading).
Seems like I shouldn't even need OSSkey... On the page you linked to, it says "If no credentials are provided, this analyzer will be disabled."

I saw the error with versions 12.1.1 to 12.1.5.

Bumping version #s to 12.1.6 fixed the issue though.

I did also add properties for ossIndexUsername/ossIndexPassword to run that analyzer as well, but it was not required with the version update.
Thanks.

[chadlwilson]

You were looking at the documentation as current at version 12.1.6. Which of course reflects the behaviour in 12.1.6 - not 12.1.5.

If you looked at the changelog you would understand why.