SonarSource/sonarqube · warning

Authentication is not enforced, and permissions assigned to…

Error message

Authentication is not enforced, and permissions assigned to the 'Anyone' group globally expose the instance to security risks. Unauthenticated visitors may unintentionally have permissions on projects.

What it means

CheckAnyonePermissionsAtStartup (invoked from start()) queries global permissions of the 'Anyone' group (null group id) at each startup. If the group holds any global permission, it logs this warning: with auth not enforced, anonymous visitors may effectively inherit those permissions on projects. It is an advisory security warning, not a failure.

Solutions

1. Remove the global permissions from the 'Anyone' group (Administration > Security > Global Permissions, or api/permissions/remove_group with groupId=null/anyone).
2. Enable authentication enforcement (sonar.forceAuthentication=true / Administration > Security) so anonymous users get no access.
3. Grant CI tokens only the specific permissions needed to named service accounts instead of 'Anyone'.
4. Review countEntitiesWithAnyonePermissions results for project-level 'Anyone' grants and clean those up too.

Example fix

// before
curl -u admin:token -X POST 'api/permissions/remove_group?groupName=Anyone&permission=provision'
// after — enforce auth and remove all Anyone permissions
sonar.forceAuthentication=true
for p in admin provisioning execute_analysis; do curl -u admin:token -X POST "api/permissions/remove_group?groupName=Anyone&permission=$p"; done

// before startup, assert Anyone has no global permissions
if (!dbClient.groupPermissionDao().selectGlobalPermissionsOfGroup(dbSession, null).isEmpty()) {
  LOG.warn("Remove global permissions from 'Anyone' and enforce authentication");
}

When it happens

Trigger: Server startup where groupPermissionDao().selectGlobalPermissionsOfGroup(dbSession, null) is non-empty — i.e. the 'Anyone' group has been granted global permissions such as Execute Analysis or Administer.

Common situations: Instances left in default/eval mode with anonymous access enabled; admins granting 'Anyone' broad permissions for convenience in CI (e.g. Execute Analysis) and forgetting them; legacy instances migrated from older permissive defaults.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• "Cannot open file " + propsFile
• Default Administrator credentials are still being used…
• ############################################################…
• Insufficient privileges
• Insufficient privileges

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/f068bc6d7e7b712b. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-core/src/main/java/org/sonar/server/platform/db/CheckAnyonePermissionsAtStartup.java:60

  public CheckAnyonePermissionsAtStartup(DbClient dbClient, Configuration config) {
    this.dbClient = dbClient;
    this.config = config;
  }

  @Override
  public void start() {
    Optional<Boolean> property = config.getBoolean(FORCE_AUTHENTICATION_PROPERTY_NAME);
    if (property.isEmpty() || Boolean.TRUE.equals(property.get())) {
      return;
    }

    logWarningsIfAnyonePermissionsExist();
  }

  private void logWarningsIfAnyonePermissionsExist() {
    try (DbSession dbSession = dbClient.openSession(false)) {
      if (!dbClient.groupPermissionDao().selectGlobalPermissionsOfGroup(dbSession, null).isEmpty()) {
        LOG.warn("Authentication is not enforced, and permissions assigned to the 'Anyone' group globally expose the " +
          "instance to security risks. Unauthenticated visitors may unintentionally have permissions on projects.");
      }

      int total = dbClient.groupPermissionDao().countEntitiesWithAnyonePermissions(dbSession);
      if (total > 0) {
        LOG.atWarn()
          .addArgument(total)
          .addArgument(String.join(", ", dbClient.groupPermissionDao().selectProjectKeysWithAnyonePermissions(dbSession, 3)))
          .log("Authentication is not enforced, and project permissions assigned to the 'Anyone' group expose {} "
            + "public project(s) to security risks, including: {}. Unauthenticated visitors have permissions on these project(s).");
      }
    }
  }

  @Override
  public void stop() {
    // do nothing
  }

View on GitHub (pinned to 184c821202)