jlnanax.blogg.se

#Login information template update

The users can then be attached (or not) to (multiple) groups. It is possible to create as many users and groups of users as needed. The way authorization is implemented in SonarQube is pretty standard. (select uuid from users where login='mylogin'), If you've deleted admin and subsequently locked out the other users with global administrative permissions, you'll need to re-grant admin to a user with the following query: INSERT INTO user_roles(uuid, user_uuid, role)

If you changed and then lost the admin password, you can reset it using the following query: update users set crypted_password='100000$t2h8AtNs1AlCHuLobDjHQTn9XppwTIx88UjqUm4s8RsfTuXQHSd/fpFexAnewwPsO6jGFQUv/24DnO55hY6Xew=', salt='k9x9eN127/3e/hf38iNiKwVfaVk=', hash_method='PBKDF2', reset_password='true', user_local='true' where login='admin' When installing SonarQube, a default user with Administer System permission is created automatically: Tokens should be passed as the value of the sonar.login property. Once established, a token is the only credential needed to run an analysis. From here, click in the user's Tokens column to see the user's existing tokens, and either revoke existing tokens or generate new ones. Similarly, all non-local accounts will be authenticated only against the external tool.Īn Administrator can manage tokens on a user's behalf via Administration > Security > Users. When you create a user in SonarQube's own database, it is considered local and will only be authenticated against SonarQube's own user/group database rather than against any external tool (LDAP, Active Directory, Crowd, etc.). See the Authentication & Authorization section of the Plugin Library.

Via external identity providers such as an LDAP server (including LDAP Service of Active Directory), GitHub etc.

Via the SonarQube built-in users/groups database.

Authentication MechanismsĪuthentication can be managed through a number of mechanisms: We advise keeping Force user authentication enabled if you have your SonarQube instance publicly accessible.

api/sources/show (for public repositories).

api/sources/scm (for public repositories).

To do this, log in as a system administrator, go to Administration > Configuration > General Settings > Security, and disable the Force user authentication property. You can disable forced user authentication, and allow anonymous users to browse projects and run analyses in your instance. Authenticationīy default, SonarQube forces user authentication. SonarQube provides a built-in mechanism to encrypt settings.

administer Quality Profiles, Quality Gates, and the SonarQube instance itself.Īnother aspect of security is the encryption of settings such as passwords.

administer a project (set exclusion patterns, tune plugin configuration for that project, etc.).

the ability to delegate to authentication (for more see Delegating Authentication)Īdditionally, you can configure at a group or user level who can:.

the ability to force users to authenticate before they can see any part of a SonarQube instance.

on-board authentication and authorization mechanisms.

SonarQube comes with a number of global security features:

#Login information template update