Assign LDAP users and groups to Groups on Sonarqube

SonarQube Server / Community Build
1

Hello, I have an issue. My goal is to synchronize user groups on LDAP with Sonarqube groups. With the Sonarqube administrator account I have created groups on sonarqube with exactly the same name. For example: admin (on LDAP) be admin on Sonarqube, developer be developer. I’ve tried configuring my sonar.properties in several different ways but I still can’t get the groups to synchronize, so that admins on LDAP automatically become admins on Sonarqube. However, I’m able to connect to Sonarqube with the LDAP user logins. What’s more, even when I try to force the administrator account (Administration > Security > Groups) to put accounts directly into admin, for example. The account is automatically removed from the group. And on the administrator account page I get the message: “insufficient privileges”.
My LDAP configuration is :

dc=lab,dc=local
   cn=readonly
   ou=Groups (4)
      cn=admin
      cn=all_users
      cn=developer
   ou=Users (8)
      cn=user1
      cn=user2
       .
       .
      cn=user8

Here my sonar.properties :

sonar.security.realm=LDAP
sonar.security.savePasswrod=true
sonar.authenticator.downcase=true

ldap.url=ldap://openldap:389
ldap.bindDn=cn=readonly,dc=lab,dc=local
ldap.bindPassword=readonly

ldap.user.baseDn=dc=lab,dc=local
ldap.user.request=(&(objectClass=inetOrgPerson)(uid={login}))
ldap.user.realNameAttribute=cn
ldap.user.emailAttribute=mail

ldap.group.baseDn=dc=lab,dc=local
ldap.group.request=(&(objectClass=groupOfNames)(member={dn}))

Is this possible in general?
I apologize in advance, it’s the first time I’ve made a message, it’s disordored. Thank you for reading

2

Hey there.

It just sounds like you haven’t found the right values to bring your group data into SonarQube.

Your configuration is going to be very specific to your environment. Inputting those values into ldapsearch is a useful way to debug those values. However, first I would focus on the SonarQube logs itself to see what is being returned when a user logs in.

You can see if Group Mapping is working correctly (SonarQube can find the groups a user belongs to in AD) by turning on DEBUG level logs (Global Administration > System > Log Level), initating a login by an externally authenticated user and checking your web.log file.

2020.09.23 00:37:52 DEBUG web[AXS3YT9O4P5KvVE3AApT][o.s.s.a.UserRegistrarImpl] List of groups returned by the identity provider ‘[G_Group1, G_Group2]’

You’ll need to adjust your ldap.group.* settings until the proper list of groups is returned.