Skip to content

Group Sync

Jump to bottom
Michael Johnson edited this page Feb 27, 2023 · 5 revisions

Syncing Groups with Active Directory

As an advanced configuration option, you can sync group membership in the Azure Active Directory with SonarQube. This feature was introduced in version 1.1 RC1 of the plugin.

This feature works by matching the names of the Active Directory groups to which the logged in user belongs with those in SonarQube and adjusting the membership on login.

Indirect group membership (user is in a group that is a member of a group) support was added in version 1.2.0 of the plugin.

Limitations

In plugin version 1, users with a large number of group memberships (>30) or with deep transitive membership structures may fail to sync properly. This limitation should be gone as of version 2 of the plugin.

Group Sync Methods

Starting with version 1.3.0 of the plugin, there are two methods available to sync groups: the default user "impersonation" method and the "client credentials" method. Each method has advantages and disadvantages, explained below. You can switch methods after setup, so if you are unsure, try using the default method first.

The "Impersonation" Method

This method is the default sync method in the plugin. It uses the authentication of the user who signed in to access the Azure AD and see what groups they have been assigned. It is called "impersonation" because the plugin pretends to be the user who has logged in.

Advantages:

  • Access to Azure AD is limited to what the user themselves can see.
  • Works with multi-tenant setups.

Disadvantages:

  • Will not work well with guest users in the AD in more restricted setups.
  • Some orgs may not like the application using access of highly-privileged users.

The "Client Credentials" Method

This method uses the application's own access to check a user's group membership. The access is restricted to read-only for further security.

Advantages:

  • Works for users with restricted guest accounts.

Disadvantages:

  • Requires giving the application/plugin access to read the entire Azure AD.
  • Does not work with multi-tenant setups.

Setting Up Group Sync

Except for the permission selected, the setup process is the same for both methods. If you want to change the method, just follow the instructions below as if you were setting sync up again.

Configuring Azure Active Directory

Note: While the below steps were current when written, the Azure Portal changes frequently. If things look different to you, you can reference the official documentation. Multiple permissions may also work for accessing the needed information. While this document references the lowest-priviledged permission at time of writing, this may change. You can refer to the permissions list to see what other permissions will work.

  1. To begin, sign into the Azure Management Portal. (If you are using one of the "national cloud" Azure instances, log in using the correct portal URL for your country.)

  2. Open the Azure Active Directory blade from the shortcut on the left, or if the shortcut is missing, search from the top of the page.

  3. On the sidebar, under the Manage category, choose App registrations and then select the application you registered for SonarQube.

  4. From the sidebar, click on API permissions and then select the Add a permission button.

  5. From the flyout, select "Microsoft Graph" and:

    • "Impersonation" Method: Choose "Delegated permissions". In the permission search box, enter "User.Read" and check that permission. Once checked, select Add permissions to add the permission.

    • "Client Credentials" Method: choose "Application permissions". In the permission search box, enter "Directory.Read.All" and check that permission. Once checked, select Add permissions to add the permission.

  6. Once back in the "Configured permissions" list, click on the Grant admin consent button to allow the permission to be used. This will grant the permissions that you selected and allow the plugin to read the user's groups. This step must be done or group sync will not work.

Configuring the Plugin

  1. Log into your SonarQube install with an account that has administrative permission.

  2. Click on the Administration header at the top, then select the Azure Active Directory tab from the general settings area.

  3. Toggle the setting labeled Enable Groups Synchronization to on/enabled to activate the plugin.

  4. If you are using the "Client Credentials" Method, toggle the advanced setting Enable Client Credential Flow to on/enabled. If you are using the "Impersonation" method, make sure the setting is disabled.

Using Group Sync

This is a very easy process. All you need to do is create a security group in SonarQube with the exact same name as what you have set up in your Active Directory.

NOTE: The name of the group in SonarQube must match your Azure AD group name exactly or the sync will not work.

Once a user logs into your SonarQube install, their group memberships will be synced with Azure AD. They will be added to any matching groups in SonarQube and removed from any SonarQube groups that do not match their AAD membership.

Contents

Clone this wiki locally