SonarQube comes out of the box Out of the box, SonarQube comes with a complete mechanism to manage security (authentication + authorization). Configuring security enables allows you to cover two main use cases:
- Manage access rights to components, information, etc.
- Enable customization (custom dashboards, notifications, etc.) of SonarQube for users
security restrictions you can
enforce by configuring security in SonarQube:
- Secure a SonarQube instance by forcing login authentication prior to access to accessing any page
- Make a given project non accessible invisible to anonymous users
- Allow Restrict access to source code (Code Viewer) a project to a given set group of users
- Restrict access to a project's source code (Code Viewer) to a given group set of users
- Define who can administer a project (setting exclusion patterns, tuning plugins configuration for that project, etc.)
- Define who can administer a SonarQube instance
Default Admin Credentials
When installing SonarQube, a unique user gets created:
- Login: admin
- Password: admin
A user is a set of basic information: login, password, name and email.
To create a new user, go to Setting > Security > Users > Add new user:
Change my Password
Log in and click on your name (top right of the screen).
When the LDAP plugin is installed and activated, it is no longer possible for users to change their password. Then, only system administrators can do so through Settings > Security > Users.
The way authorization is implemented in SonarQube is pretty standard. It is possible to create as many users and groups of users as required in the system. The users can then be attache (or not) to (multiple) groups. Groups and / or users are then given (multiple) roles. The roles grant access to projects, services and functionalities.
A group is a set of users.
To create a new group, go to Settings > Security > Groups > Add new group:
To add/remove users to/from a group:
Two groups have a special meaning:
- Anyone is a group that exists in the system, but that cannot be managed. Every user belongs to this group.
- sonar-users is the group to which users are automatically added. This group can be changed through the Global Security Settings (
There are 5 different roles, 2 are global, the 3 others are defined at project level:
- Global roles:
- System Administrators have the ability to perform all administration tasks on the SonarQube instance like global configuration, customization of the home page, etc.
- Quality Profile Administrators have the ability to perform any changes on quality profiles (since version 3.6)
Note that roles are not cumulative. For instance, if you want to be able to administer the project, browse the measures and browse the source code, you have to be given the three roles: Administrator, User and Code Viewer.
Default project roles
It is possible to configure the system so that when a new project is created, some users/groups are automatically granted roles on this project.
In the example below, once a new project has been created:
- All the users in the sonar-administrators group can administrate (Administrators), access the project (Users) and browse the source code (Code viewers).
- The myAuditor user can access access the project (Users) and browse the source code (Code viewers).
Delegation to an External System
In order to leverage existing enterprise infrastructure, SonarQube provides the capability to delegate authentication and authorization to external systems through plugins:
- LDAP with the SonarQube LDAP Plugin
- Active Directory with the SonarQube LDAP Plugin
- PAM with the SonarQube PAM Plugin
- Crowd with the SonarQube Crowd Plugin
Authentication and authorization can also be delegated to an external system: LDAP or Active Directory with the SonarQube LDAP Plugin, PAM with the SonarQube PAM Plugin or Crowd with the SonarQube Crowd Plugin. SSO is also supported through the SonarQube OpenID plugin.
I have locked myself out
There is currently nothing that stops you removing from every user and every group the global administrator role. the global administrator role. You then have no other solution than make an manual update in the SonarQube database to get back in control.
INSERT INTO user_roles(user_id, role) VALUES ((select id from users where login='mylogin'), 'admin');
I have lost the admin password
In case you lost the admin password of your SonarQube instance, you can reset it by running the following update statement :
update users set crypted_password = '88c991e39bb88b94178123a849606905ebf440f5', salt='6522f3c5007ae910ad690bb1bdbf264a34884c6d' where login = 'admin'
This will reset the password to adminAnother aspect of security is the encryption of settings such as passwords. SonarQube provide a built-in mechanism to encrypt settings.