Hello Team,
Is it possible to remove the “More option” in SonarQube login page.
I know this has been answered with a “No” before through this link:
Our organization just wishes for the latest confirmation that this cannot be removed.
Thank you!
Hi,
Here’s your latest confirmation: No.
Seriously though, if you remove that link then you remove any way to log in with a local account and fix things if integration with your IDP goes south. It’s not vestigial; it’s there on purpose.
Ann
I’ve seen this request a few times and for me, its related to security. Security scanners (and the people that run them) don’t like a self-hosted web login with basic auth available on the web, especially if it doesn’t have brute force or other protections listed as features in documentation. It can be a security nightmare if a bad actor is able to brute force their way in, or a login vulnerability allows someone in to see what projects a team has and what vulnerabilities they can attack.
My solution is put it behind a firewall or VPN, but that raises the barrier of entry for devs to access and some will rather ignore the internal vulnerabilities than slog through the VPN login process to then access this page.
Assuming as I’ve seen in previous comments from Sonar staff, that we can’t RTFM and find the backdoor access if we get locked out, so this is what we all get is kinda frustrating from a company that sells security software.
One solution that would really help me (specifically for docker compose/K8s or the like) would be being able to disable the login page via a container flag and allow an automatic SAML redirect if you hit the link. Then if we are dumbdumbs and lock ourselves out of SAML login, we can simply remove the container flag restart the app and get the login page with the basic auth back to sign in and fix the SAML issues.
@blastingbits You raise some good points. I’ve flagged this for attention from our PMs.
Really appreciate you looking into this. It would help me a lot if this was implemented in some form!
I know this is a super old topic, but now that this ‘more option’ doesn’t exist and it is actually shown by default its even more confusing to users. I’m with Ray on this, that as sys admins and maintainers of the sonar platfrom for our orgs it would be nice if we could set a prop file value or provide an jvm arg to enable/disable this. If we break the config we still have glass breaking capabilities but it will remove infinite amount of confusion from users who click the wrong link and try to locally authenticate since they don’t know what SAML actually is.
If Sonar wants the official positon to be on by default great, but having the ability to remove this ‘feature’ would be extremely useful under real world conditions.
Hi @munkyxtc,
Welcome to the community!
You have the ability to add a message to that login screen, and that was set up for this exact purpose.
It’s under Administration → General.
HTH,
Ann
We have updated the message but still leads to confusion. I feel like I’m being gaslit by support haha.
This is a legit problem and giving admins the ability to turn it off and glass break if needed is the perfect solution that most apps support.
Nowadays, bruteforce attacks and techniques for bypass logins are each more sophisticated, I think the best solution could be flag for enable login for local user on sonar properties and add 2FA for this user for maintain custodian double. Normally, We will use always SAML with mfa because security requisites, but there is way this directioned attack for simple web form though login for local user. Let’s imaginate the attacker got sucess my source code could be leaked on web it is very danger or some big company is attacked and leaked the local login for sonar, this company could be very prejudicated.
I believe this point should be threated more urgency considering the risks above mentioned, for while Sonar Source company thinking about it, I was thinking if the api used by login local is different than api used by saml, if this is true. I could create a waf rule that allow this page only accessed specifics ip’s, decrease exposition this page for bad actor. Could be validate it, please?
Thank you
Best Regards,
Thales
Hi Thales,
I’ve flagged this for the PMs to consider the 2FA suggestion.
Local login and SAML use different mechanisms, so this should be feasible.
The best way to master the API (and see which URLs to block) is to perform the desired action via the UI and eavesdrop to see which calls the UI made to accomplish the action.
You may also find this guide helpful.
HTH,
Ann