# DevOps Platform Integration with GitLab shows permission error **URL:** \ **Category:** SonarQube Server / Community Build\ **Created:** [May 30, 2023, 8:00am UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686 "2023-05-30T08:00:32Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![NatanD](https://avatars.discourse-cdn.com/v4/letter/n/ecae2f/32.png) [@NatanD](https://community.sonarsource.com/u/NatanD)\ **Post date:** [May 30, 2023, 8:00am UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686/1 "2023-05-30T08:00:33Z")
- EE Version 9.9 - GitLab EE 15.11.x - Deployed using Docker (Self Managed) - We have an integration set up for GitLab and Bitbucket. Recently our projects imported from GitLab started showing an error regarding permission scope of the personal access token used on the settings page. When looking at the global settings, as referenced in the error, all is OK. The user is an admin user with access to all project in our GitLab instance. ```auto You have the following errors in your configuration: The personal access token has been created with a user with insufficient permissions on the project. Requires at least REPORTER role permission. Please check your global settings. ``` - Already tried to replace the token with a new one. It’s confusing since on GitLab you’re not able to scope a personal access token to a specific role. Only project and group access tokens can be scoped to a role. [Personal access tokens | GitLab](https://docs.gitlab.com/15.11/ee/user/profile/personal_access_tokens.html#create-a-personal-access-token) ![Screenshot 2023-05-30 at 09.13.18](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/b/6/b615164c9b4c8965e44b24f385eafe0ee9f402a7.png) ![Screenshot 2023-05-30 at 09.13.27](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/a/0/a0392f18c8cdbaed0d9a0b418b2622a9eaa100ca.png) ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [May 31, 2023, 9:24am UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686/2 "2023-05-31T09:24:03Z")
Hey there. We had an issue reported internally where, for some reason, one of our pre-sales engineers needed to add both _read_ **and** _read\_api_ permissions to the token. The issue seemed to resolve itself (perhaps something on GitLab’s side). If you’re still facing the issue, can you give this a try? ---
**Author:** ![NatanD](https://avatars.discourse-cdn.com/v4/letter/n/ecae2f/32.png) [@NatanD](https://community.sonarsource.com/u/NatanD)\ **Post date:** [June 2, 2023, 7:02am UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686/3 "2023-06-02T07:02:45Z")
Hey I tried recreating the token with those 2 scopes, didn’t seem to resolve the issue. Also tried a token with all scopes added. Same result. Might this happen since the user is an admin user and not directly added to any groups or projects? It can view the groups and projects in the explore tab tho. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [June 6, 2023, 12:29pm UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686/4 "2023-06-06T12:29:39Z")
If this was always the case for your admin user, then I wouldn’t expect the behavior to change overnight. I would suggest checking the log files (specifically [web.log](https://docs.sonarqube.org/latest/setup-and-upgrade/troubleshooting/)) when you try to verify the configuration to see if any more detailed errors appear than what you see in SonarQube. You can also raise the log level if needed via the global **Administration \> System \> Log Level** ---
**Author:** ![DDuarte](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/dduarte/32/46400_2.png) [@DDuarte](https://community.sonarsource.com/u/DDuarte)\ **Post date:** [June 20, 2023, 4:29pm UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686/5 "2023-06-20T16:29:11Z")
This seems to be a recent behaviour changed in Sonar (or perhaps Gitlab). I’m on Sonar Version 10.0 (build 68432) and Gitlab 15.11.6 and I’m not sure when it started. It is related to the Gitlab user not being added explicitly to all repositories. There’s an API call to Gitlab `[o.s.a.c.g.GitlabHttpClient] get project : [https://gitlab.example.com/api/v4/projects?min_access_level=20&id_after=9999&id_before=10001]` which returns no projects unless the user was added to the project Members, even if the user is admin and has access to everything. Removing `min_access_level=20` from the query properly returns the project. ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/4/b/4b0afde6c3c3ed31b05cf7d2ef5d8748066c8401.png) ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [June 21, 2023, 6:56am UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686/7 "2023-06-21T06:56:44Z")
Thanks @DDuarte. I’ve flagged this for some experts. ---
**Author:** ![pierreguillot](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/pierreguillot/32/46022_2.png) [@pierreguillot](https://community.sonarsource.com/u/pierreguillot)\ **Post date:** [June 22, 2023, 2:41pm UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686/9 "2023-06-22T14:41:36Z")
Hello folks, thanks for reporting this. Indeed, it looks like Gitlab administrators can’t search for projects using the `min_access_level` filter, which would require them to have an actual membership in the project (or one of the parent group). Workaround is to add the Gitlab admin to top-level groups, or to every project that needs MR decoration from SQ. I want to point out that “only” the validation is failing: since the Gitlab admin actually has permission to comment on the MR of any project, the SQ \<\> Gitlab integration will work, and MR will get decorated. (The feature works, but not the validation). This is something we can improve, and I created a [bug ticket on our side](https://sonarsource.atlassian.net/browse/SONAR-19695) to work on. On the other hand, I’d personally discourage you from using a Gitlab global admin personal access token for the SonarQube integration: Following the [principle of least privilege](https://en.wikipedia.org/wiki/Principle_of_least_privilege), only the `Reporter` Permission is needed. You could create a dedicated user, having only the `Reporter` permission, add this user to the groups, and that will work. ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [June 29, 2023, 2:41pm UTC](https://community.sonarsource.com/t/devops-platform-integration-with-gitlab-shows-permission-error/91686/11 "2023-06-29T14:41:43Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.