Users, Groups, Permissions, Tokens, Authentication, and Authorization: Guided Hands-On Workflow

1. Lab contract and safety boundary

2. Preflight: capture the starting authorization state

Before changing anything, record the server/scanner versions and capture screenshots or exported notes for:

• Administration → Security → Global Permissions, especially the sonar-users Execute Analysis grant.
• Administration → Security → Groups and Users.
• Administration → Security → Permission Templates.
• Administration → Projects → Management and the default visibility.

export SONAR_HOST_URL="http://localhost:9000"
sonar-scanner --version
git --version
curl -fsS "$SONAR_HOST_URL/api/system/status" | tee evidence-system-status.json

3. Create two synthetic source fixtures

mkdir -p sq-ch21-rbac/{alpha,beta}
for team in alpha beta; do
  cd "sq-ch21-rbac/$team"
  git init
  git config user.email "learner@example.invalid"
  git config user.name "SQ Chapter 21"
  cat > app.py <<'PY'
def hello(name: str) -> str:
    return f"hello {name}"
PY
  cat > sonar-project.properties <<EOF
sonar.projectKey=sq-ch21-${team}-app
sonar.projectName=SQ Chapter 21 ${team^} App
sonar.sources=.
sonar.exclusions=.git/**,.scannerwork/**
sonar.sourceEncoding=UTF-8
EOF
  git add .
  git commit -m "chapter21 ${team} baseline"
  git rev-parse HEAD > "../${team}-revision.txt"
  cd ../..
done

These revisions remain fixed through the permission experiment. Authorization results must not be confounded with source changes.

4. Create disposable users and groups

Using a local administrator account, create users sq21-alpha and sq21-beta under Administration → Security → Users. Use temporary local-only passwords that are not written into the repository or evidence packet. Then create groups:

• sq-ch21-alpha-devs containing only sq21-alpha.
• sq-ch21-beta-devs containing only sq21-beta.

Capture membership evidence. Do not add either user to sonar-administrators.

5. Preserve, then narrow the default global Execute Analysis grant

In Administration → Security → Global Permissions, confirm whether sonar-users has Execute Analysis. If it does, record the original state and then remove that one global grant for the duration of this disposable lab.

Immediately record the new state and the planned rollback: restore Execute Analysis to sonar-users if that was the original state.

6. Create and apply project permission templates

Create two templates before creating the projects:

Template: SQ21 Alpha
Pattern: ^sq-ch21-alpha-.*
Group sq-ch21-alpha-devs:
  Browse Project
  See Source Code
  Execute Analysis on project

Template: SQ21 Beta
Pattern: ^sq-ch21-beta-.*
Group sq-ch21-beta-devs:
  Browse Project
  See Source Code
  Execute Analysis on project

Create sq-ch21-alpha-app and sq-ch21-beta-app as private projects. Verify that the appropriate template was applied. If a project was created before the template, use the documented project administration flow to apply the intended template and record that action.

7. Create two credential types per team

Log in as each disposable user rather than generating routine credentials under the administrator account.

1. Create a project-analysis token for the user’s own project. Choose a short explicit expiration.
2. Create a separate user token for read-only API verification, also with a short expiration.
3. Copy each value once into an environment variable; never store it in Git, screenshots, or the evidence packet.

# Example names only. Enter actual temporary values interactively.
read -rsp "Alpha project-analysis token: " SQ_ALPHA_ANALYSIS_TOKEN; echo
read -rsp "Alpha limited user token: " SQ_ALPHA_USER_TOKEN; echo
export SQ_ALPHA_ANALYSIS_TOKEN SQ_ALPHA_USER_TOKEN

The user token is not intrinsically “read only”; its practical authority is bounded by the sq21-alpha user’s permissions. This is why service-user design matters.

8. Prove an allowed Alpha analysis

cd sq-ch21-rbac/alpha
export SONAR_TOKEN="$SQ_ALPHA_ANALYSIS_TOKEN"
mkdir -p evidence/alpha-allowed
sonar-scanner -X 2>&1 | tee evidence/alpha-allowed/scanner.log
cp .scannerwork/report-task.txt evidence/alpha-allowed/report-task.txt
ALPHA_TASK="$(sed -n 's/^ceTaskId=//p' .scannerwork/report-task.txt)"
printf '%s\n' "$ALPHA_TASK" > evidence/alpha-allowed/ceTaskId.txt
curl -fsS -H "Authorization: Bearer $SQ_ALPHA_USER_TOKEN" \
  "$SONAR_HOST_URL/api/ce/task?id=$ALPHA_TASK" \
  > evidence/alpha-allowed/ce-task.json

Wait for terminal Compute Engine state. Preserve scanner success, ceTaskId, CE success, project visibility, and gate state separately.

9. Prove cross-team denial without changing the project key

Now use Alpha’s project-analysis token against the Beta project configuration. Do not solve the failure by creating another project key.

cd ../beta
export SONAR_TOKEN="$SQ_ALPHA_ANALYSIS_TOKEN"
set +e
sonar-scanner -X 2>&1 | tee evidence-alpha-denied-on-beta.log
STATUS=${PIPESTATUS[0]}
set -e
printf 'scanner_exit=%s\n' "$STATUS" | tee evidence-alpha-denied-exit.txt

test "$STATUS" -ne 0

The exact server/scanner wording may vary, but the invariant is that an authenticated Alpha project-analysis credential must not be allowed to push an analysis to Beta.

10. Read-only API allow/deny evidence

# Alpha can read its own private project.
curl -sS -o evidence-alpha-own.json -w '%{http_code}\n' \
  -H "Authorization: Bearer $SQ_ALPHA_USER_TOKEN" \
  "$SONAR_HOST_URL/api/measures/component?component=sq-ch21-alpha-app&metricKeys=ncloc" \
  | tee evidence-alpha-own-status.txt

# Alpha tries to read Beta. Preserve the real status/body.
curl -sS -o evidence-alpha-beta.json -w '%{http_code}\n' \
  -H "Authorization: Bearer $SQ_ALPHA_USER_TOKEN" \
  "$SONAR_HOST_URL/api/measures/component?component=sq-ch21-beta-app&metricKeys=ncloc" \
  | tee evidence-alpha-beta-status.txt

Depending on endpoint/privacy behavior, a server may expose a permission denial or deliberately hide a private resource. Record the actual response. Do not infer “project absent” until authorization has been checked.

11. Revoke and prove failure

Revoke Alpha’s project-analysis token under My Account → Security. Then rerun the smallest equivalent Alpha scan at the same revision:

cd ../alpha
export SONAR_TOKEN="$SQ_ALPHA_ANALYSIS_TOKEN"   # value is now revoked server-side
set +e
sonar-scanner 2>&1 | tee evidence-revoked-analysis.log
REVOKED_SCAN=${PIPESTATUS[0]}
set -e
printf 'revoked_scan_exit=%s\n' "$REVOKED_SCAN" | tee evidence-revoked-analysis-exit.txt
test "$REVOKED_SCAN" -ne 0

Then revoke Alpha’s user token and retry the read-only API request. Preserve the actual invalid/revoked-authentication response. This proves credential lifecycle cleanup rather than merely documenting that somebody clicked “Revoke.”

12. Cleanup and rollback

• Revoke all Chapter 21 tokens.
• Restore sonar-users global Execute Analysis only if it was present before the lab.
• Delete only the two disposable projects, users, groups, and templates created for this lab after evidence export.
• Do not delete shared users/groups, change global profiles/gates, touch database/search state, or purge unrelated Docker resources.
• Unset shell variables: unset SQ_ALPHA_ANALYSIS_TOKEN SQ_ALPHA_USER_TOKEN SONAR_TOKEN.

13. Challenge: choose the correct layer

Beta’s scanner token suddenly stops working after a group cleanup even though the token has not expired. What should you inspect?

Check the token owner’s effective Execute Analysis permission first. Current project/global analysis tokens depend on the owner retaining the corresponding Execute Analysis permission; a still-unexpired token can become unusable when its owner loses authority.

Knowledge check

Official references and version notes

• Managing permissions — Community Build — current global/project permissions, default sonar-users Execute Analysis grant, visibility, and permission templates.
• Managing groups — additive direct/group permission model and built-in groups.
• Managing your tokens — user/project/global analysis token types, expiration, revocation, and owner-permission dependency.
• Administering tokens — administrator generation/revocation responsibilities.
• User accounts — built-in/delegated authentication and forced-authentication guidance.
• Web API — bearer authentication, token-expiration response header, form-data guidance, and Web API V2 transition.
• Current SonarQube downloads — Community Build 26.9.0.129388 baseline.
• SonarScanner CLI 8.1.0.6389 — scanner baseline used by the local analysis proofs.