How to set all existing projects to private in SonarQube?

farooq.ind · November 15, 2018, 2:11pm

Hi,

How to change sonar-users permission for all existing projects?

Which template will be applicable if multiple templates matches the criteria (including default one)?

Thanks,
Farooq

ganncamp · November 15, 2018, 6:31pm

Hi,

You can easily do this by creating a new permissions template that doesn’t grant the Anyone pseudo-group any permissions and apply it to all projects.

HOWEVER before you do that, you should be aware that applying such a template will overwrite all existing permissions settings for your projects, so this should be approached with extreme caution.

Another option is to require users to log in just to access the instance (Administration > Security > Force user authentication). It doesn’t remove anonymous rights from your projects, but it does keep anonymous users from getting to your projects to exercise their rights, which is pretty much just as good.

HTH,
Ann

farooq.ind · November 15, 2018, 6:37pm

Thanks for the response.

As you mentioned if a new template is created & applied then it will overwrite existing permission settings.
We have multiple templates applied for different group of projects. If we create a new template to not grant Anyone group any access then all existing permission sets will be lost.

Is there any easy option or any option via Web API?

Moreover, it would be very helpful if you can share your feedback on other 2 queries as well.

How to change sonar-users permission for all existing projects?

Which template will be applicable if multiple templates matches the criteria (including default one)?

Thanks
Farooq

ganncamp · November 15, 2018, 6:53pm

Hi Farooq,

The answer for the sonar-users group is pretty much the same as for Anyone.

However, given that you do have multiple extant permissions templates you can simply edit them to reflect the changes you want and reapply them one by one.

To be specific about that, templates have no on-going relationships with projects. If I create a project, some permission template will be applied. If I then edit the template, the project is unaffected until and unless I reapply the template to the project. You can easily do that on the Projects
page (Administration > Projects > Management > Bulk Apply Permission Template), presumably after you’ve run a search to narrow the set of projects to affect.

This question is only relevant at project creation. If there are multiple templates with a matching Project Key Pattern, I’m not sure which one will be applied. Ideally, you’ll avoid the question.

Ann

farooq.ind · November 15, 2018, 7:13pm

Thanks a lot Ann.

We want to make all existing projects private so that we can remove “see source code” permission from sonar-users group, as that option appears only when we make project private. Screenshots given below.

Hence, currently we have 2 main requirements:

Make all existing projects private (in a go).
Remove “see source code” permission from sonar-users group for all existing projects.

You think there is any other way to achieve this ?

Thanks,
Farooq

ganncamp · November 15, 2018, 7:26pm

Hi Farooq,

I’ve given you what comes to mind.

Ann

farooq.ind · November 15, 2018, 7:29pm

Hi Ann,

So it means there is no option to make all existing projects private in one go?
We need to do it project by project? I am actually checking because we have 498 projects totally.

Thanks,
Farooq

sagarvs · May 29, 2019, 7:56pm

Hi All,

I have the same requirement. We just rolled out to many applications and everyone can see everyone’s source code. As I have thousands of projects, need to web api to update the projects to private. Any Suggestions please. Thank you,

Sagar

ganncamp · May 30, 2019, 11:38am

Hi Sagar,

Welcome to the community. A review of this old thread reminds me that I shared several scenarios for making this happen. Can you be explicit about how the advice given above isn’t clear to you?

Thx,
Ann

farooq.ind · May 30, 2019, 12:50pm

Hi Ann,

The solution mentioned by you is not sufficient for my requirement. Need is to make bulk existing projects private in one go .

Thx

Farooq

ganncamp · May 30, 2019, 1:08pm

Hi again Farooq,

As I said earlier, your best bet is to set a permission template to the permissions you want and bulk apply it via Administration > Projects > Management.

Ann

sagarvs · May 30, 2019, 4:11pm

Hi Ann,

Thanks. It a pleasure to be part of the Sonar Community. Applying permission template does not include the feature to make the project private, so the solution will not help.

But I was able to find the api to make bulk update to make projects private. I created a simple Jenkins job and run for about 2k projects which took about 15 mins to update all projects as Private. Following is the command I used and hope this helps others. Thank you,

curl -X POST -v -u user:passwod ‘http://localhost:9000/api/projects/update_visibility?project=<prj_key>&visibility=private’

Thanks
Sagar

farooq.ind · May 30, 2019, 6:02pm

Thanks a lot Sagar.
This is really helpful.

This was the solution I was looking for.

ganncamp · May 30, 2019, 6:16pm

Hi guys,

I was going to reply that public/private was just a shortcut for changes you could make by applying a permissions template. But a little experimentation has reminded me that for public projects you can’t turn off Browse and See Source Code, regardless of what’s in your template.

This behavior was initially introduced to accommodate SonarCloud, but there have been questions about whether it’s really appropriate in SonarQube. I’ll bring this up internally. Sorry I’ve been so dense about this.

Ann

sagarvs · May 30, 2019, 7:30pm

Hi Ann,

I agree, even though the project is public. There should an option not to show the source code. This will help securing the source code. Thank you

Regards,
Sagar

sagarvs · May 30, 2019, 7:30pm

Glad it helped!

Valentijn_Scholten · April 9, 2020, 12:27pm

Any progress on this? I have about 200 projects to set to private and most of them have different permission templates.

sim.sisavuthary · March 18, 2021, 3:53pm

Hello,
I am a newcomer. Now I have the same issue, all existing projects are public.
I can set the existing projects to private one by one but one project can a few developers work together. How can we allow access?

solkee · August 4, 2021, 7:57am

For those using PowerShell the following has worked using the api ‘api/projects/update_visibility’.
Http:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$user = "<admin_user>"
$securedValue = Read-Host "Please Enter Password " -AsSecureString
$bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($securedValue)
$value = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
$combocred = "$($user):$($value)"
$encodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($combocred))
$headers = @{"Authorization" = "Basic "+$encodedCreds}
Invoke-RestMethod -Uri "http://<sonarqubeurl>:9000/api/projects/update_visibility?project=<Project_Key>&visibility=private" -Method Post -Headers $headers -ContentType "application/json"

HTTPS:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$user = "<admin_user>"
$securedValue = Read-Host "Please Enter Password " -AsSecureString
$bstr = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($securedValue)
$value = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($bstr)
$combocred = "$($user):$($value)"
$encodedCreds = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($combocred))
$headers = @{"Authorization" = "Basic "+$encodedCreds}
Invoke-RestMethod -Uri "https://<sonarqubeurl>/api/projects/update_visibility?project=<Project_Key>&visibility=private" -Method Post -Headers $headers -ContentType "application/json"