Unable to authenticate _csrf token based web application in OWASP ZAP zap-full-scan.py docker - owasp

Question

I am using docker.io/owasp/zap2docker-weekly zap-full-scan.py to execute on a target.
Below is the jenkins pipeline script -
pipeline {
agent { label master }
stages {
stage ('Pull Docker Image') {
steps {
sh 'docker images'
}
}
stage ('Scan Host') {
steps {
catchError(buildResult: 'SUCCESS', stageResult: 'FAILURE') {
sh """sudo docker run -v /home/root/workspace/ZAP_docker/Reports:/zap/wrk/:rw -t docker.io/owasp/zap2docker-weekly zap-full-scan.py \
-I -j -m 30 -T 60 \
-t https://${params.IP}:${params.PORT}/webui.* \
-d -r testreport.html \
-g gen.conf \
-z "auth.loginurl=https://${params.IP}:${params.PORT}/webui/login \
auth.username=${params.USERNAME} \
auth.password=${params.PASSWORD} \
auth.username_field="username" \
auth.password_field="password" \
auth.submit_field="login-btn"""
}
}
}
stage ('Publish Report') {
steps {
archiveArtifacts artifacts: 'logs/*, Reports/*', followSymlinks: false
}
}
stage ('Send a Report') {
steps {
office365ConnectorSend message: 'ZAP PROXY Report Alert!!!!', webhookUrl: 'dfdfDF'
}
}
}
}
Below are my questions -
How can i clarify if the zap has logged into the application, or the login has been failed or the authentication has been failed.
My application has the csrf token based authentication
username=abc&password=abc&_csrf=4334345-435345354-435345345-2a-02c38a3d9e20
Now zap is not scanning with login auth.
I am able to perform end to end scan on OWASP ZAP desktop. However I want to automate this using jenkins pipeline.

Answer 1

-z is for ZAP config options, which does not include:
-z "auth.loginurl=https://${params.IP}:${params.PORT}/webui/login \
auth.username=${params.USERNAME} \
auth.password=${params.PASSWORD} \
auth.username_field="username" \
auth.password_field="password" \
auth.submit_field="login-btn"""
^ those seem to be ICTU specific, and don't seem to include any logged in or logged out indicator ...
You could properly setup your Context via ZAP GUI, then export it and use it in your scan with the options:
-n context_file context file which will be loaded prior to scanning the target
-U user username to use for authenticated scans - must be defined in the given context file (post 2.9.0)
Or you could configure things via the ZAP Web API and use custom scan hooks to leverage it.