SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

QProfileWsSupport.checkCanEdit guards all quality-profile editing web services (adding/deleting rules, activating rules, changing inheritance). Editing requires the global ADMINISTER_QUALITY_PROFILES permission or a per-profile editing grant for the user or one of their groups; the user must also pass canEdit in QProfileWsSupport. Built-in profiles are rejected before the permission check via checkNotBuiltIn.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualityprofile/ws/QProfileWsSupport.java:113

      return true;
    }
    UserDto user = dbClient.userDao().selectByLogin(dbSession, userSession.getLogin());
    checkState(user != null, "User from session does not exist");
    return dbClient.qProfileEditUsersDao().exists(dbSession, profile, user)
      || dbClient.qProfileEditGroupsDao().exists(dbSession, profile, userSession.getGroups());
  }

  boolean canAdministrate(QProfileDto profile) {
    if (profile.isBuiltIn() || !userSession.isLoggedIn()) {
      return false;
    }
    return userSession.hasPermission(GlobalPermission.ADMINISTER_QUALITY_PROFILES);
  }

  public void checkCanEdit(DbSession dbSession, QProfileDto profile) {
    checkNotBuiltIn(profile);
    if (!canEdit(dbSession, profile)) {
      throw insufficientPrivilegesException();
    }
  }

  public void checkCanAdministrate(QProfileDto profile) {
    checkNotBuiltIn(profile);
    if (!canAdministrate(profile)) {
      throw insufficientPrivilegesException();
    }
  }

  void checkNotBuiltIn(QProfileDto profile) {
    checkRequest(!profile.isBuiltIn(), "Operation forbidden for built-in Quality Profile '%s' with language '%s'", profile.getName(), profile.getLanguage());
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Grant global 'Administer Quality Profiles' permission to the user.
2. Or grant per-profile user/group edit permission via api/qualityprofiles/add_user / add_group (permissions endpoints).
3. If the target is a built-in profile, copy it first (api/qualityprofiles/copy) and edit the copy.
4. Check group membership — per-profile grants are often made to a group the user must belong to.

Example fix

// before: user edits profile without rights
curl -u usertoken: -X POST "$SONAR/api/qualityprofiles/activate_rule?language=java&qualityProfile=TeamProfile&rule=squid:S001"

// after: grant edit permission on the profile
curl -u admintoken: -X POST "$SONAR/api/qualityprofiles/add_group?language=java&qualityProfile=TeamProfile&groupName=devs"

// Built-in profiles are never editable:
if (profile.isBuiltIn()) return false;
// Require global permission:
curl -u "$TOKEN": "$SONAR/api/permissions/user?login=$USER" | grep 'profileadmin'

boolean canEditProfile(QProfileDto p, UserSession s) {
  return !p.isBuiltIn() && s.hasPermission(GlobalPermission.ADMINISTER_QUALITY_PROFILES);
}

When it happens

Trigger: Calling api/qualityprofiles/activate_rule, change_parent, deactivate_rule, rename, or delete on a profile the user cannot edit — no global 'Administer Quality Profiles' permission and no user/group edit permission on that profile.

Common situations: Teams copying SonarSource's per-profile permission model but forgetting to grant group edit rights; users editing a built-in profile like 'Sonar way' (fails checkNotBuiltIn first, but permission also missing); post-upgrade permission resets.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/a78b28c4e03c0b70. Report an issue: GitHub.