Description / Features
This plugin enables the delegation of SonarQube authentication to underlying PAM subsystem. The plugin works on *nix boxes with the Pluggable Authentication Module (PAM).
Only password-checking is done against PAM. Authorization (access control) is still fully managed in SonarQube. During the first authentication trial, if the password is correct, the SonarQube database is automatically populated with the new user. The System administrator should assign the user to the desired groups in order to grant him necessary rights. If a password exists in the SonarQube database, it will be ignored because the external system password will override it.
OS and Architecture
Mac OS X PPC
Windows all flavours
Should work, not tested
Does not work
Usage & Installation
- Install jpam
- Install the plugin through the Update Center or download it into the SONARQUBE_HOME/extensions/plugins directory
- Make sure that at least one user with global administration role exists in SonarQube as well as in the external system
Update the SONARQUBE_HOME/conf/sonar.properties file by adding the following lines:
Restart SonarQube and check logs for:
- Log in to SonarQube
Since SonarQube 4.2, technical users can be set. Technical users are authenticated against SonarQube's own database of users, rather than against any external tool (LDAP, Active Directory, Crowd, etc.).
Similarly, all accounts not flagged as local will be authenticated only against the external tool. By default
admin is a technical account. Technical accounts are configured in SONARQUBE_HOME/conf/sonar.properties in the
sonar.security.localUsers (default value = admin) property as a comma-separated list.
Crash using PAM winbind authentication (pam_winbind.so)
In case of an unsucessful login for a bad password or a locked account (a bad username does not produce the same issue) you may get this kind of error while using pam winbind authentication:
In this case SonarQube crashes and restarts automatically.
It appears to be a pam_winbind.so issue. This workaround is available:
- Edit /etc/security/pam_winbind.conf:
Set Kerberos authentication: