SonarSource/sonarqube · error · ForbiddenException

noPermissionSourceMessage(projectKey, reason)

Error message

noPermissionSourceMessage(projectKey, reason)

What it means

ReportSubmitter.wouldCurrentUserHaveScanPermission determines whether the current user may submit a report for projectKey. If the instance is externally managed, any reason reported by the DevOps project creator why DevOps-platform permissions are unavailable is surfaced as a ForbiddenException via noPermissionSourceMessage. Otherwise it falls back to checking the default permission template.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/queue/ReportSubmitter.java:214

      return devOpsProjectCreator.createProjectAndBindToDevOpsPlatform(dbSession, SCANNER_API_DEVOPS_AUTO_CONFIG, false, projectKey, projectName, false);
    }
    return projectCreator.createProject(dbSession, componentKey.getKey(), defaultIfBlank(projectName, projectKey), null, SCANNER_API);
  }

  private void throwIfCurrentUserWouldNotHaveScanPermission(String projectKey, DbSession dbSession, @Nullable DevOpsProjectCreator devOpsProjectCreator) {
    if (!wouldCurrentUserHaveScanPermission(projectKey, dbSession, devOpsProjectCreator)) {
      throw insufficientPrivilegesException();
    }
  }

  private boolean wouldCurrentUserHaveScanPermission(String projectKey, DbSession dbSession, @Nullable DevOpsProjectCreator devOpsProjectCreator) {
    if (userSession.hasPermission(SCAN)) {
      return true;
    }
    if (managedInstanceService.isInstanceExternallyManaged() && devOpsProjectCreator != null) {
      devOpsProjectCreator.permissionsFromDevopsPlatformUnavailableReason()
        .ifPresent(reason -> {
          throw new ForbiddenException(noPermissionSourceMessage(projectKey, reason));
        });
      return devOpsProjectCreator.isScanAllowedUsingPermissionsFromDevopsPlatform();
    }
    return permissionTemplateService.wouldUserHaveScanPermissionWithDefaultTemplate(dbSession, userSession.getUuid(), projectKey);
  }

  /**
   * The analysis cannot create the project: the token holds no global 'Execute Analysis' permission, and the DevOps platform
   * cannot be queried to resolve the permissions of the current user either. Both conditions are reported, since knowing only
   * one of them is not enough to fix the configuration.
   */
  private static String noPermissionSourceMessage(String projectKey, String devOpsPlatformUnavailableReason) {
    return format("Project '%s' does not exist and cannot be created by this analysis. The token does not have the 'Execute Analysis'"
      + " permission, and %s. Create and bind the project first (POST %s), or grant the 'Execute Analysis' permission.",
      projectKey, devOpsPlatformUnavailableReason, BOUND_PROJECTS_ENDPOINT);
  }

  private CeTask submitReport(DbSession dbSession, InputStream reportInput, ComponentDto branch, BranchDto mainBranch, Map<String, String> characteristics) {

View on GitHub (pinned to 184c821202)

Solutions

1. Fix the DevOps platform integration: verify the project binding and that the platform token is valid
2. Confirm the user has Execute Analysis via the DevOps platform role mapping
3. On non-managed instances, add Execute Analysis in the project's default permission template
4. Grant explicit project Execute Analysis permission if DevOps sync is not required

boolean canScan = wsClient.get("api/permissions/search?project=" + key + "&permission=scan")
  .hasComponentFor(currentUser); if (!canScan) skipSubmit(key);

try { submit(report); } catch (ForbiddenException e) { log(e.message); notifyAdmin(); }

When it happens

Trigger: POST to api/ce/submit on an externally managed instance where the project creator (e.g. Azure DevOps/GitLab integration) reports it cannot fetch permissions from the DevOps platform (bad binding, expired platform token, project not linked).

Common situations: DevOps platform integration misconfigured or token revoked; project not provisioned/bound so the platform cannot confirm scan permission; default permission template lacking Execute Analysis for the submitting user on non-managed instances.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• You're not authorized to push analysis results to the SonarQ
• Plugin [%s] does not exist
• Unknown severity: %s
• Identity provider %s does not exist or is not enabled

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/ff9a2af114f55722. Report an issue: GitHub.