SonarSource/sonarqube · error · ForbiddenException

User doesn't have rights to requested resource anymore.

Error message

User doesn't have rights to requested resource anymore.

What it means

validateUsersDeactivationStatus checks userSession.isActive() after permissions have been validated and throws ForbiddenException 'User doesn't have rights to requested resource anymore.' when the user session is inactive (deactivated user). It ensures deactivated accounts cannot keep consuming push events even if stale permission grants exist.

Source

Thrown at server/sonar-webserver-pushapi/src/main/java/org/sonar/server/pushapi/sonarlint/SonarLintClientPermissionsValidator.java:79

    }
    UserSession userSession = userSessionFactory.create(userDto, false);
    List<ProjectDto> projectDtos;
    try (DbSession dbSession = dbClient.openSession(false)) {
      projectDtos = dbClient.projectDao().selectByUuids(dbSession, projectUuids);
    }
    validateProjectPermissions(userSession, projectDtos);
  }

  private static void validateProjectPermissions(UserSession userSession, List<ProjectDto> projectDtos) {
    validateUsersDeactivationStatus(userSession);
    for (ProjectDto projectDto : projectDtos) {
      userSession.checkEntityPermission(ProjectPermission.USER, projectDto);
    }
  }

  private static void validateUsersDeactivationStatus(UserSession userSession) {
    if (!userSession.isActive()) {
      throw new ForbiddenException("User doesn't have rights to requested resource anymore.");
    }
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Reactivate the user in SonarQube (Administration > Users) if access should continue.
2. Stop/disconnect the SonarLint client or rotate its credentials after deactivation.
3. Use an active dedicated service account for automated push-event consumers.

Example fix

// before
// automated job runs with deactivated user 'old-bot'
// after
// provision an active service account and use it
sonarClient.login("svc-sonarlint-bot", activeToken);

// check the account is active before use: GET api/users/search?q=<login> and verify 'active': true

try { pushClient.poll(); } catch (ForbiddenException e) { if (e.getMessage().contains("anymore")) { stopPolling(); alertOperator("account deactivated"); } }

When it happens

Trigger: A push-event request from a user whose account has been deactivated in SonarQube but whose SonarLint client still holds a session/token.

Common situations: Offboarding: an employee is deactivated while their IDE keeps polling SonarLint push events; automated clients using service accounts that were disabled.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• User does not exist
• Param {paramKey} was not provided.
• Param projectKeys is invalid.
• Insufficient privileges
• %s is not a valid url

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/da52cfd7cd07febb. Report an issue: GitHub.