Permissions Not Working on Custom Quality Profiles

[estesb1 (Brittney Estes)]

We have SonarQube Cloud Enterprise Plan

• ALM used (GitHub, Bitbucket Cloud, Azure DevOps)
  GitHub

• CI system used (Bitbucket Cloud, Azure DevOps, Travis CI, Circle CI
  GitHub Actions

• Scanner command used when applicable (private details masked)
  N/A

• Languages of the repository
  N/A

• Only if the SonarCloud project is public, the URL

  • And if you need help with pull request decoration, then the URL to the PR too
    N/A

• Error observed (wrap logs/code around with triple quotes ``` for proper formatting)
  N/A

• Steps to reproduce

1. Created a Custom Quality Profile (Extended from built-in “Sonar Way” profile)
2. Activated a new rule (Maximum Cyclomatic Complexity Threshold: 10)
3. Selected “Grant permissions to more users” and selected “Owners” group
4. Test Scenario 1: Tested a user who was NOT in the “Owners” group to ensure that they could not update the custom Quality Profile
   *** The user that I tested did NOT have the Quality Profiles permissions selected, or any other organization-level permission.

***Test Scenario 2:

1. Removed the “Owners” group from the Quality Profile and tested the same user in the first scenario.

Expected Results: I expected the Activate/Deactivate buttons to be disabled but this was not the case.

Actual Results: The user could access the custom profile AND edit it (activate/deactivate rules)

There are a lot of projects in our organization that we have to manage (~700 projects). Since there isn’t a way for us to audit profile updates, we want to only allow changes from permitted users. Can you please help us with this issue?

[Colin]

Hey there.

You’ll want to make sure that you remove the global Administer Quality Profiles permission from the Owners group.

[estesb1 (Brittney Estes)]

So, for clarity, I’m not actually trying to restrict the Owners group. Instead, I’d like to disallow users who are not in the Owners group (i.e., the Members group) from making changes to the Quality Profile. Do I need to add the Members group under ‘Permissions’ and deselect ‘Quality Profiles’ privilege instead?

[estesb1 (Brittney Estes)]

Hi @Colin , I’m not sure if you saw my previous message but I tried your proposed solution with the ‘Members’ group and the problem still is not resolved. Even with the “Quality Profiles” permission deselected, users in the group are still able to access and update the Quality Profile that I am trying to lock down. Could you please provide further assistance?

[estesb1 (Brittney Estes)]

Update:

It works now! I needed to remove the ‘Members’ group from the ‘Permissions’ section under the Quality Profile.

Thank you.