CODEWITHSUNDEEP
sonarquberole-based-access-control
Jirong Hu
Jirong Hu

Reputation: 2375

How to do role based access control with SonarQube?

I am new to SonarQube and trying to setup up a proper access control, with requirements as follows:

  1. We have a few project areas, each area should have someone able to manage their area, such as creating new projects and manage the boards, not sure exactly what. This is something like project area administrators.
  2. A few administrators can do anything.
  3. Integrate to AD

A few questions:

  1. In a few places like this link: http://www.sonarsource.com/products/features/security/, I see this role based method, but I can't find these default roles, "SonarSource products come with three project-specific roles – project administrators, project users and project code viewers" anywhere in the system. Right now, I am using the community edition I guess without a license. Is there any more detailed document on that?
  2. I kind of understand the default Global Permissions and Project Permissions. In my case, shall I create e.g. three groups in AD, sonar-administrators,sonar-project-administrators, sonar-users to map to the default groups?
  3. I notice the following: right now I don't have the above AD groups, when I integrate to AD, I can login with my domain id/password, but once logout/in, the group information I added to the local user gone. I guess it sych with AD. So to use AD, I have to create these groups in AD?

Jirong

Upvotes: 2

Views: 7776

Answers (1)

Nicolas B.
Nicolas B.

Reputation: 7321

Access control in SonarQube is managed through Global Permissions and Project Permissions. Each permission can be granted to user(s) and/or to group(s). The documentation you pointed at is quite outdated, read the Authorization page for the most up to date details.

AD/LDAP integration is a different topic, documented here. With group mapping, group membership stays managed in AD but will be replicated in SonarQube when users log in (the AD groups must first be created in SonarQube with the same name).

To your example: if AD users belonging to group foo deserve to administer your SonarQube, just create group foo in SonarQube, and (in the Global Permissions settings) give Administer System permission to group foo.

Upvotes: 8

Related Questions