# How to auto-apply a Permission template (with Project Key Pattern) **URL:** \ **Category:** SonarQube Server / Community Build\ **Tags:** sonarqube\ **Created:** [May 1, 2020, 3:24pm UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985 "2020-05-01T15:24:00Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Denis](https://community.sonarsource.com/u/Denis)\ **Post date:** [May 1, 2020, 3:24pm UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/1 "2020-05-01T15:24:00Z")
Hi there, SonarQube version 8.2 here. I found many suggestions like “you can set up permission templates that are applied automatically based on project key patterns”. While so far I was not able to test this successfully. What I tried so far: 1. Created a Permission template with Project Key Pattern “^xxxx-|^XXXX-” to react on a project prefix. 2. Applied this to my Portfolio 3. Created a new project - default template permissions were assigned. That’s ok. 4. Added a Tag to attach my Project to my Portfolio 5. Permissions didn’t change. 6. Run a pipeline and executed a scan. Pushed for the data into my new project. Permissions are still the same. 7. Went to the Portfolio and re-applied the Template again (hoping this will distribute the permissions to all childs matching the name. 8. Permissions are still the same (Original from Default template) Of course I can select few projects (matching and not macthing the prefix) and apply the Template manually. But in that case it doesn’t case about the prefix and applied to all projects selected. So the question is: how do you apply this “automatically”? Please advise. Thanks. ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [May 1, 2020, 5:28pm UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/2 "2020-05-01T17:28:41Z")
Hi, Permission templates are applied automatically at project _creation_ and… never again unless you apply them manually _directly to the project_. Inclusion in a portfolio has no impact. A project could be a member of multiple portfolios. If permissions were inherited from portfolio to project I guess this would be a last-saved-wins nightmare. You need to figure out why they’re not being applied at step 3. Off-hand, the guess for that would be a problem with your key pattern.   HTH, Ann ---
**Author:** ![Denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Denis](https://community.sonarsource.com/u/Denis)\ **Post date:** [May 4, 2020, 8:58am UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/3 "2020-05-04T08:58:40Z")
Hi Ann, Thanks for your prompt response. Could you please suggest an option for our scenario then? We have 1 instance. We have multiple Dev Teams. We separate the Teams on Portfolio level. As by default all Sonar users see all new projects we created a default template that removes “browse” for all sonar-users. So by default only owner can see and modify the Project settings. Then we’d apply a template to asssign a proper group (based on Portfolio). Which as you are explaining doesn’t seem possible. What are our options then to have the group auto-assignment? As from what I see in security settings there can be only 1 default template assigned to all Projects. So creating multiple Templates and separate them by Project Key Pattern is not an option. Every time someone creates a new project and asks an admin to manually apply a template also not the most convenient option. So what would be the best practice for such case? Maybe separate on Application level? never tested this. Thanks. ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [May 4, 2020, 5:06pm UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/4 "2020-05-04T17:06:13Z")
Hi, > [@Denis](#): > > What are our options then to have the group auto-assignment? > As from what I see in security settings there can be only 1 default template assigned to all Projects. > So creating multiple Templates and separate them by Project Key Pattern is not an option. Yes and no. There is only 1 default. Think of it as the `default` in a `switch`. If no other conditions match, it will be applied. But before you get to it, you have the chance to match the project key patterns set up in the other templates. Does that make sense?   Ann ---
**Author:** ![Denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Denis](https://community.sonarsource.com/u/Denis)\ **Post date:** [May 7, 2020, 9:30am UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/5 "2020-05-07T09:30:16Z")
Hi Ann, Sorry, not completely. Are you saying I can have 20 custom templates with different Key Patterns and then when I am creating a new project and the name would match one of these I’d get assigned appropriate permissions? As this doesn’t seem so. I tested this scenario already and that doesn’t work. Also your response gets more confusing, as “Default” template can mean 2 different things: 1 is the built-in template with name “Default” and 2 is a template that has been assigned with parameter Default Template for Project/Portfolio/Application. So we have 3 types on templates: 1. Default. 2. Custom with parameter Default for Project 3. Custon with Key Pattern. So what is a correct way to detect 1 of 20 Teams by the name prefix and assign an appropriate template for each case? Thanks. ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [May 7, 2020, 12:09pm UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/6 "2020-05-07T12:09:41Z")
Hi, The patterns in permissions templates don’t match project _names_, they match _keys_.   HTH, Ann ---
**Author:** ![Denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Denis](https://community.sonarsource.com/u/Denis)\ **Post date:** [May 7, 2020, 12:59pm UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/7 "2020-05-07T12:59:02Z")
All above is still valid for cases when Name == Key. Which is our case. Please advise of this. Thanks. ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [May 7, 2020, 6:01pm UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/8 "2020-05-07T18:01:08Z")
Hi, I’ve just done some testing to make sure my memory was accurate and there haven’t been any regressions in this area. It was, and there haven’t. In a new instance I created some test users and a template: ![Selection_999(078)](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/2/2ab3dc16b277ed2ea3d68f09a7dcd86c2202e56a.jpeg) Then I analyzed a project with key=com.sonarsource.rule-api:rule-api. Here are its resulting permissions: ![Selection_999(079)](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/8/84ad37dffb49c55a82bad9c519f0a0dbc60940c1.jpeg) Note that my first test didn’t work. I used a bash pattern (`com.sonar*`) rather than a valid regular expression (`com.sonar.*`). And just for the record, here’s my untouched default (as in what will be used for projects if nothing else is a match): ![Selection_999(080)](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/5/51196455d01bc634efb6f1f18492aebf7092f5c3.jpeg)   HTH, Ann ---
**Author:** ![Denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Denis](https://community.sonarsource.com/u/Denis)\ **Post date:** [May 8, 2020, 10:08am UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/9 "2020-05-08T10:08:39Z")
Hi Ann, So with other words answer to my question below > [@Denis](#): > > Are you saying I can have 20 custom templates with different Key Patterns and then when I am creating a new project and the name would match one of these I’d get assigned appropriate permissions? is **YES** 🙂 Thank you. I’ve tested more and indeed found an issue in my regular expression. To close this topic could you confirm 1 more thign for me? I want to add Projects to Portfolio automatically as well. I found that I can do so using the same principal - regular expression. I’ve tested this and it works well. Only 1 thing is bothering me: When creating a new Project it doesn’t get attached to the Portfolio right away. But only after first scan. So the question is: is that the only option or there is some kind of cron job on the background that would attach the project within some certain time even without scan? Please clarify. Thank you. ---
**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\ **Post date:** [May 8, 2020, 11:25am UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/10 "2020-05-08T11:25:20Z")
Hi, I’m glad you worked through the permissions issue. Technically I should make you open a new thread for the project/portfolio question, but… There aren’t really\* _any_ crons in SonarQube. If you want that you’ll have to set up an external job that uses web services to find your new projects and associate them with the portfolio. But then that would be a _manual_ assignment, not one based on regex. Your best bet is just to analyze promptly or to allow first analysis to do the project creation.   HTH, Ann \*IIRC there’s actually one that runs once a day to see if we need to send out any notices about the license - close to renewal time? close to LOC limit? … ---
**Author:** ![Denis](https://avatars.discourse-cdn.com/v4/letter/d/5e9695/32.png) [@Denis](https://community.sonarsource.com/u/Denis)\ **Post date:** [May 8, 2020, 11:46am UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/11 "2020-05-08T11:46:18Z")
Copy that. Thanks a lot Ann. This case can now be closed. ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [May 15, 2020, 12:00pm UTC](https://community.sonarsource.com/t/how-to-auto-apply-a-permission-template-with-project-key-pattern/23985/12 "2020-05-15T12:00:01Z")
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.