I’m setting up a new SonarCloud Enterprise instance and am having issues getting the group mappings from Entra ID to SonarCloud to connect. I used Bitbucket cloud for my initial admin/create login. I had my admin co-worker do the same, and we were both able to use SSO to login (we now have two accounts). I’ve setup the group mappings in the org, and triple checked they are case-sensitive matches to what is setup in Entra ID, and set permissions. When I have users from other Entra ID groups login using the provided Enterprise SSO login, they are given access to SonarCloud, but get a message “The page you were looking for does not exist” and a popup message at the bottom that “User uuid xxxxxx is not allowed to get enterprise uuid xxxxx”. If I have them go to their user icon (top right) it shows their correct user name, company email and “SSO”, but they do not show any current Enterprises or Orgs, just “new” options. I searched for the user in the “add member” option under the org, but that does not find them. It’s like the SSO is active but not connected to my enterprise or org. How do I connect the pieces?
Hello @waltersj_act,
Welcome to the community. Seeing the scenario you mentioned above, it looks to be an issue with the groups mapping. Can you login using your admin credentials and configure SAML again. This time on the Self Service SSO page, in the Test SSO step, click Test Connection. Can you confirm if you are seeing the groups attribute as part of the response here? If you don’t see it, then you need to fix the attribute mapping on Entra.
Cheers,
Sarath
I had done this for myself, and confirmed I saw the “Sonar_Admin” group returned, and it is working for my other member of the Admin group, so I know that one is correct. To test a different group I had one of my other teammates, a member of a different “Sonar_” group, use the Bitbucket login (so I could see his user and give him admin privileges on the Enterprise) then go to the SSO settings and send me the JSON he received back. He got “sonar_developers” instead of the expect “Sonar_Developers”. Sure enough, everything was camel case EXCEPT the sAMAccountName for this group. Whoever did this one made that one all lowercase, for the other 3 groups it matches across all values. This was hard to spot because what was listed in Entra and the cn were both camel case so it all appeared to be matching until we checked the actual value returned.
I updated the group name in SonarQube Cloud, everyone is now able to get in with SSO and is properly matched to our org.