`sonar.projectVersion` | The project version. | `<version>` for Maven projects, otherwise "not provided"
### Authentication
-If the "Anyone" pseudo-group does not have permission to perform analyses, you'll need to supply the credentials of a user with Execute Analysis permission for the analysis to run under.
+By default, user authentication is required to prevent anonymous users from browsing and analyzing projects on your instance, and you need to pass these parameters when running analyses. Authentication is enforced in the global Security(/instance-administration/security/) settings.
+When authentication is required or the "Anyone" pseudo-group does not have permission to perform analyses, you'll need to supply the credentials of a user with Execute Analysis permissions for the analysis to run under.
Key | Description | Default
---|----|---
-`sonar.login` | The login or authentication token of a SonarQube user with Execute Analysis permission on the project. |
-`sonar.password` | The password that goes with the `sonar.login` username. This should be left blank if an authentication token is being used. |
+`sonar.login` | The [authentication token](/user-guide/user-token/) or login of a SonarQube user with Execute Analysis permission on the project. |
+`sonar.password` | If you're using an authentication token, leave this blank. If you're using a login, this is the password that goes with your `sonar.login` username. |
### Web Services
Key | Description | Default
The SonarScanner for Ant provides a `task` to allow integration of SonarQube analysis into an Apache Ant build script.
-The SonarScanner for Ant is an Ant Task that is wrapper of [SonarScanner](/analysis/scan/sonarscanner/), which works by invoking SonarScanner and passing to it all [properties](/analysis/analysis-parameters/) named following a `sonar.*` convention. This has the downside of not being very Ant-y, but the upside of providing instant availability of any new analysis parameter introduced by a new version of SonarQube. Therefore, successful use of the SonarScanner for Ant requires strict adherence to the property names shown below.
+The SonarScanner for Ant is an Ant Task that is a wrapper of [SonarScanner](/analysis/scan/sonarscanner/), which works by invoking SonarScanner and passing to it all [properties](/analysis/analysis-parameters/) named following a `sonar.*` convention. This has the downside of not being very Ant-y, but the upside of providing instant availability of any new analysis parameter introduced by a new version of SonarQube. Therefore, successful use of the SonarScanner for Ant requires strict adherence to the property names shown below.
-## Use
+## Using the SonarScanner for Ant
Define a new sonar Ant target in your Ant build script:
```
<!-- build.xml -->
<sonar:sonar />
</target>
```
-Run the following command from the project base directory to launch the analysis:
+
+Run the following command from the project base directory to launch the analysis. You need to pass an [authentication token](/user-guide/user-token/) using the `sonar.login` property in your command line:
```
-ant sonar
+ant sonar -Dsonar.login=yourAuthenticationToken
```
-
## Sample Project
To help you get started, a simple project sample is available here: https://github.com/SonarSource/sonar-scanning-examples/tree/master/sonarqube-scanner-ant
1. Open the Connections page in your Azure DevOps Server project: **Project Settings > Pipelines > Service Connections**.
1. Click **New service connection** and choose **SonarQube**.
-1. Specify a **Connection name**, the **Server URL** of your SonarQube Server (including the port if required), and the [Authentication Token](/user-guide/user-token/) to use
+1. Specify a **Connection name**, the **Server URL** of your SonarQube Server (including the port if required), and the [authentication token](/user-guide/user-token/) to use.
Each extension provides three tasks you will use in your build definitions to analyze your projects:
| * **Publish Quality Gate Result** task after the **Run Code Analysis** task
|1. Click on the **Prepare Analysis Configuration** build step to configure it:
| * You must specify the service connection (i.e. SonarQube) to use. You can:
-| * select an existing endpoint from the drop down list
+| * select an existing endpoint from the drop-down list
| * add a new endpoint
| * manage existing endpoints
| * Keep **Integrate with MSBuild** checked and specify at least the project key
| Download and unzip **Build Wrapper** on the build agent (see *Prerequisites* section of *C/C++/Objective-C* page). The archive to download and decompress depends on the platform of the host.\
| Please, note that:
| * For the Microsoft-hosted build agent you will need to do it every time (as part of build pipeline), e.g. you can add **PowerShell script** task doing that. This can be done by inserting a **Command Line** task.\
-| Example of PowerShell commands on a windows host:
+| Example of PowerShell commands on a Windows host:
| ```
| Invoke-WebRequest -Uri '<sonarqube_url>/static/cpp/build-wrapper-win-x86.zip' -OutFile 'build-wrapper.zip'
| Expand-Archive -Path 'build-wrapper.zip' -DestinationPath '.'
| curl '<sonarqube_url>/static/cpp/build-wrapper-macosx-x86.zip' --output build-wrapper.zip
| unzip build-wrapper.zip
| ```
-| * For the self-hosted build agent you can either download it everytime (using the same scripts) or only once (as part of manual setup of build agent).
+| * For the self-hosted build agent you can either download it every time (using the same scripts) or only once (as part of the manual setup of build agent).
|2. Add a **Prepare analysis Configuration** task and configure it as follow:\
| Click on the **Prepare analysis on SonarQube** task to configure it:
| * Select the **SonarQube Server**
| * In *Choose the way to run the analysis*, select *standalone scanner* (even if you build with *Visual Studio*/*MSBuild*)
| * In *Additional Properties* in the *Advanced* section, add the property `sonar.cfamily.build-wrapper-output` with, as its value, the output directory to which the Build Wrapper should write its results: `sonar.cfamily.build-wrapper-output=<output directory>`
|3. Add a **Command Line** task to run your build.\
-| For the analysis to happen, your build has to be run through a command line so that it can be wrapped-up by the build-wrapper.
+| For the analysis to happen, your build has to be run through a command line so that it can be wrapped up by the build-wrapper.
| To do so,
| * Run **Build Wrapper** executable. Pass in as the arguments (1) the output directory configured in the previous task and (2) the command that runs a clean build of your project (not an incremental build).\
-| Example of PowerShell commands on a windows host with an *MSBuild* build:
+| Example of PowerShell commands on a Windows host with an *MSBuild* build:
| ```
| build-wrapper-win-x86/build-wrapper-win-x86-64.exe --out-dir <output directory> MSBuild.exe /t:Rebuild
| ```
|
|1. In your build definition, add:
| * At least **Prepare Analysis Configuration** task and **Run Code Analysis** task
-| * Optionaly **Publish Quality Gate Result** task
+| * Optionally **Publish Quality Gate Result** task
|1. Reorder the tasks to respect the following order:
| 1. **Prepare Analysis Configuration**
| 2. **Run Code Analysis**
Next time some code is pushed in the branch of a pull request, the build definition will execute a scan on the code and publish the results in SonarQube which will decorate the pull request in Azure DevOps.
-_Note : The number of comments posted in a PR is limited to 50. If this limit has been reached, a message will be displayed as a comment, with a link to the rest of the issues on SonarQube. Please note also that this comment will not disappear upon resolution of an issue, but only upon a new build, with less than 50 issues remaining._
+_Note: The number of comments posted in a PR is limited to 50. If this limit has been reached, a message will be displayed as a comment, with a link to the rest of the issues on SonarQube. Please note also that this comment will not disappear upon resolution of an issue, but only upon a new build, with less than 50 issues remaining._
## FAQ
Bytecode created by javac compilation is required for Java analysis, including Android projects.
## Configure the Scanner
-Installation is automatic, but certain global properties should still be configured. A good place to configure global properties is `~/.gradle/gradle.properties`. Be aware that the scanner uses system properties so all properties should be prefixed by `systemProp`.
+Installation is automatic, but certain global properties should still be configured. A good place to configure global properties is `~/.gradle/gradle.properties`. Be aware that the scanner uses system properties so all properties should be prefixed by `systemProp`.
```
# gradle.properties
systemProp.sonar.host.url=http://localhost:9000
-
-#----- Token generated from an account with 'publish analysis' permission
-systemProp.sonar.login=<token>
```
## Analyzing
Assuming a local SonarQube server with out-of-the-box settings is up and running, no further configuration is required.
-Execute `gradle sonarqube` and wait until the build has completed, then open the web page indicated at the bottom of the console output. You should now be able to browse the analysis results.
+You need to pass an [authentication token](/user-guide/user-token/) using the `sonar.login` property in your command line or you configure it as part of your `gradle.properties` file. Execute `gradle sonarqube -Dsonar.login=yourAuthenticationToken` and wait until the build has completed, then open the web page indicated at the bottom of the console output. You should now be able to browse the analysis results.
## Analyzing Multi-Project Builds
To analyze a project hierarchy, apply the SonarQube plugin to the root project of the hierarchy. Typically (but not necessarily) this will be the root project of the Gradle build. Information pertaining to the analysis as a whole has to be configured in the sonarqube block of this project. Any properties set on the command line also apply to this project.
1. Configure your SonarQube server(s):
1. Log into Jenkins as an administrator and go to **Manage Jenkins > Configure System**.
1. Scroll down to the SonarQube configuration section, click **Add SonarQube**, and add the values you're prompted for.
- 1. The server authentication token should be created as a 'Secret Text' credential.
+ 1. The server [authentication token](/user-guide/user-token/) should be created as a 'Secret Text' credential.
## Analyzing a .NET solution
**Global Configuration**
-This step is mandatory if you want to trigger any of your analyses with the SonarScanner for MSBuild. You can define as many scanner instances as you wish. Then for each Jenkins job, you will be able to choose with which launcher to use to run the SonarQube analysis.
+This step is mandatory if you want to trigger any of your analyses with the SonarScanner for MSBuild. You can define as many scanner instances as you wish. Then for each Jenkins job, you will be able to choose which launcher to use to run the SonarQube analysis.
1. Log into Jenkins as an administrator and go to **Manage Jenkins > Global Tool Configuration**
1. Click on **Add SonarScanner for MSBuild**
1. Add an installation of the latest available version. Check **Install automatically** to have the SonarScanner for MSBuild automatically provisioned on your Jenkins executors
**Job Configuration**
1. Configure the project, and go to the **Build** section.
1. Add the SonarQube for MSBuild - Begin Analysis to your build
-1. Configure the SonarQube Project Key, Name and Version in the SonarScanner for MSBuild - Begin Analysis build step
+1. Configure the SonarQube Project Key, Name, and Version in the SonarScanner for MSBuild - Begin Analysis build step
1. Add the MSBuild build step or the Execute Windows batch command to execute the build with MSBuild 14 (see compatibility) to your build.
1. Add the SonarQube for MSBuild - End Analysis build steps to your build
## Analyzing other project types
**Global Configuration**
-This step is mandatory if you want to trigger any of your SonarQube analyses with the SonarScanner. You can define as many scanner instances as you wish. Then for each Jenkins job, you will be able to choose with which launcher to use to run the SonarQube analysis.
+This step is mandatory if you want to trigger any of your SonarQube analyses with the SonarScanner. You can define as many scanner instances as you wish. Then for each Jenkins job, you will be able to choose which launcher to use to run the SonarQube analysis.
1. Log into Jenkins as an administrator and go to **Manage Jenkins > Global Tool Configuration**
1. Scroll down to the SonarScanner configuration section and click on Add SonarScanner. It is based on the typical Jenkins tool auto-installation. You can either choose to point to an already installed version of SonarScanner (uncheck 'Install automatically') or tell Jenkins to grab the installer from a remote location (check 'Install automatically')
-If you don't see a drop down list with all available SonarScanner versions but instead see an empty text field then this is because Jenkins still hasn't downloaded the required update center file (default period is 1 day). You may force this refresh by clicking 'Check Now' button in Manage Plugins > Advanced tab.
+If you don't see a drop-down list with all available SonarScanner versions but instead see an empty text field then this is because Jenkins still hasn't downloaded the required update center file (default period is 1 day). You may force this refresh by clicking the 'Check Now' button in Manage Plugins > Advanced tab.
**Job Configuration**
1. **Configure** the project, and go to the **Build** section.
}
```
-Here are a some examples for every scanner, assuming you run on Unix slaves and you have configured a server named "My SonarQube Server" as well as required tools. If you run on Windows slaves, just replace `sh` with `bat`.
+Here are some examples for every scanner, assuming you run on Unix slaves and you have configured a server named "My SonarQube Server" as well as required tools. If you run on Windows slaves, just replace `sh` with `bat`.
SonarScanner:
```
}
```
-## Pause pipeline until quality gate is computed
-The `waitForQualityGate` step will pause the pipeline until SonarQube analysis is completed and returns quality gate status.
+## Pause pipeline until the Quality Gate is computed
+The `waitForQualityGate` step will pause the pipeline until SonarQube analysis is completed and returns Quality Gate status.
### Pre-requisites:
* Configure a webhook in your SonarQube server pointing to `<your Jenkins instance>/sonarqube-webhook/`
```
## Analyzing
-Analyzing a Maven project consists of running a Maven goal: `sonar:sonar` from the directory that holds the main project `pom.xml`.
+Analyzing a Maven project consists of running a Maven goal: `sonar:sonar` from the directory that holds the main project `pom.xml`. You need to pass an [authentication token](/user-guide/user-token/) using the `sonar.login` property in your command line.
+
```
-mvn clean verify sonar:sonar
+mvn clean verify sonar:sonar -Dsonar.login=myAuthenticationToken
```
In some situations you may want to run the `sonar:sonar` goal as a dedicated step. Be sure to use `install` as first step for multi-module projects
```
mvn clean install
-mvn sonar:sonar
+mvn sonar:sonar -Dsonar.login=myAuthenticationToken
```
To specify the version of sonar-maven-plugin instead of using the latest:
To get coverage information, you'll need to generate the coverage report before the analysis.
-
-
## Configuring Analysis
Most analysis properties will be read from your project. If you would like override the default values of specify additional parameters, configure the parameter names found on the [Analysis Parameters](/analysis/analysis-parameters/) page in the `<properties>` section of your pom.xml like this:
```
</properties>
```
-
## Sample Project
To help you get started, a simple project sample is available here: https://github.com/SonarSource/sonar-scanning-examples/tree/master/sonarqube-scanner-maven
```
export MAVEN_OPTS="-Xmx512m"
```
-On Windows environments, avoid the double-quotes, since they get misinterpreted.
+In Windows environments, avoid the double-quotes, since they get misinterpreted.
```
set MAVEN_OPTS=-Xmx512m
```
title: SonarScanner for .NET
---
-<!-- sonarqube -->
<update-center updatecenterkey="scannermsbuild"></update-center>
-<!-- /sonarqube -->
-
-<!-- sonarcloud -->
-[[info]]
-| **Download SonarScanner for .NET 5.0.0** - [Issue Tracker](https://github.com/SonarSource/sonar-scanner-msbuild/issues) – [Source](https://github.com/SonarSource/sonar-scanner-msbuild)
-|
-| [Standalone executables](https://github.com/SonarSource/sonar-scanner-msbuild/releases/download/5.0.0.23533) |
-| [.NET Core Global Tool](https://www.nuget.org/packages/dotnet-sonarscanner)
-<!-- /sonarcloud -->
[[info]]
| Since version 5.0, the SonarScanner for MSBuild is now the SonarScanner for .NET.
The SonarScanner for .NET is the recommended way to launch an analysis for projects/solutions using MSBuild or dotnet command as a build tool. It is the result of a [collaboration between SonarSource and Microsoft](http://www.sonarqube.org/announcing-sonarqube-integration-with-msbuild-and-team-build/).
-SonarScanner for .NET is distributed as a standalone command line executable, as an extension for <!-- sonarcloud -->[Azure DevOps](/analysis/scan/sonarscanner-for-azure-devops/)<!-- /sonarcloud --><!-- sonarqube -->[Azure DevOps Server](/analysis/scan/sonarscanner-for-azure-devops/)<!-- /sonarqube -->, and as a plugin for [Jenkins](/analysis/scan/sonarscanner-for-jenkins/).
+SonarScanner for .NET is distributed as a standalone command line executable, as an extension for [Azure DevOps Server](/analysis/scan/sonarscanner-for-azure-devops/), and as a plugin for [Jenkins](/analysis/scan/sonarscanner-for-jenkins/).
It supports .Net Core on every platform (Windows, macOS, Linux).
## Prerequisites
-<!-- sonarqube -->
+
* At least the minimal version of Java supported by your SonarQube server
-<!-- /sonarqube -->
-<!-- sonarcloud -->
-* Java 11 or greater
-<!-- /sonarcloud -->
* The SDK corresponding to your build system:
* [.NET Framework v4.6](https://www.microsoft.com/fr-fr/download/details.aspx?id=53344) - either [Build Tools for Visual Studio 2015 Update 3](https://go.microsoft.com/fwlink/?LinkId=615458) or the [Build Tools for Visual Studio 2017](https://www.visualstudio.com/downloads/)
* [.NET Core SDK 2.0 and above](https://dotnet.microsoft.com/download) (for .NET Core version of the scanner or if you plan to use [.NET Core Global Tool](https://www.nuget.org/packages/dotnet-sonarscanner)
[[info]]
-| The flavor used to compile the Scanner for .NET (either .NET Framework, .NET Core or .NET) is independant of the .NET version the
-| project you want to analyze has been built with. Concretly, you can analyze .NET Core code with the .NET Framework version of
+| The flavor used to compile the Scanner for .NET (either .NET Framework, .NET Core or .NET) is independent of the .NET version the
+| project you want to analyze has been built with. Concretely, you can analyze .NET Core code with the .NET Framework version of
| the Scanner. It's only relevant depending on your OS, and on the versions of .NET SDKs that are installed on your build machine.
-<!-- sonarqube -->
### Compatibility
Scanner Version|SonarQube
---|---
5.x| LTS 6.7+
4.x| LTS 6.7+
-<!-- /sonarqube -->
## Installation
### Standalone executable
* Expand the downloaded file into the directory of your choice. We'll refer to it as `$install_directory` in the next steps.
- * On Windows, you might need to unblock the ZIP file first (Right click on file > Properties > Unblock).
+ * On Windows, you might need to unblock the ZIP file first (right-click **file > Properties > Unblock**).
* On Linux/OSX you may need to set execute permissions on the files in `$install_directory/sonar-scanner-(version)/bin`.
-* Uncomment, and update the global settings to point to <!-- sonarqube -->your SonarQube server<!-- /sonarqube --><!-- sonarcloud -->SonarCloud<!-- /sonarcloud --> by editing `$install_directory/SonarQube.Analysis.xml`. Values set in this file will be applied to all analyses of all projects unless overwritten locally.
+* Uncomment, and update the global settings to point to your SonarQube server by editing `$install_directory/SonarQube.Analysis.xml`. Values set in this file will be applied to all analyses of all projects unless overwritten locally.
Consider setting file system permissions to restrict access to this file.:
```xml
<SonarQubeAnalysisProperties xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.sonarsource.com/msbuild/integration/2015/1">
- <Property Name="sonar.host.url"><!-- sonarqube -->http://localhost:9000<!-- /sonarqube --><!-- sonarcloud -->https://sonarcloud.io<!-- /sonarcloud --></Property>
+ <Property Name="sonar.host.url">http://localhost:9000</Property>
<Property Name="sonar.login">[my-user-token]</Property>
</SonarQubeAnalysisProperties>
```
.NET Core Global Tool is available from .NET Core 2.1+
-<!-- sonarqube -->
### On Linux/OSX, if your SonarQube server is secured
1. Copy the server's CA certs to `/usr/local/share/ca-certificates`
2. Run `sudo update-ca-certificates`
-<!-- /sonarqube -->
## Use
| You can invoke the Scanner using arguments with both dash (-) or forward-slash (/) separators.
| Example : SonarScanner.MSBuild.exe begin /k:"project-key" or SonarScanner.MSBuild.exe begin -k:"project-key" will work.
-There are two versions of the SonarScanner for .NET.
+There are two versions of the SonarScanner for .NET. In the following commands, you need to pass an [authentication token](/user-guide/user-token/) using the `sonar.login` property.
The first version is based on the "classic" .NET Framework. To use it, execute the following commands from the root folder of your project:
```
-SonarScanner.MSBuild.exe begin /k:"project-key" <!-- sonarcloud -->/o:"<organization>" /d:sonar.login="<token>" <!-- /sonarcloud -->
+SonarScanner.MSBuild.exe begin /k:"project-key" /d:sonar.login="myAuthenticationToken"
MSBuild.exe <path to solution.sln> /t:Rebuild
-SonarScanner.MSBuild.exe end <!-- sonarcloud -->/d:sonar.login="<token>" <!-- /sonarcloud -->
+SonarScanner.MSBuild.exe end /d:sonar.login="myAuthenticationToken"
```
Note: On Mac OS or Linux, you can also use `mono <path to SonarScanner.MSBuild.exe>`.
The second version is based on .NET Core which has a very similar usage:
```bash
-dotnet <path to SonarScanner.MSBuild.dll> begin /k:"project-key" <!-- sonarcloud -->/o:"<organization>" /d:sonar.login="<token>" <!-- /sonarcloud -->
+dotnet <path to SonarScanner.MSBuild.dll> begin /k:"project-key" /d:sonar.login="<token>"
dotnet build <path to solution.sln>
-dotnet <path to SonarScanner.MSBuild.dll> end <!-- sonarcloud -->/d:sonar.login="<token>" <!-- /sonarcloud -->
+dotnet <path to SonarScanner.MSBuild.dll> end /d:sonar.login="myAuthenticationToken"
```
The .NET Core version can also be used as a .NET Core Global Tool.
```bash
dotnet tool install --global dotnet-sonarscanner
-dotnet sonarscanner begin /k:"project-key" <!-- sonarcloud -->/o:"<organization>" /d:sonar.login="<token>" <!-- /sonarcloud -->
+dotnet sonarscanner begin /k:"project-key" /d:sonar.login="myAuthenticationToken"
dotnet build <path to solution.sln>
-dotnet sonarscanner end <!-- sonarcloud -->/d:sonar.login="<token>" <!-- /sonarcloud -->
+dotnet sonarscanner end /d:sonar.login="myAuthenticationToken"
```
+
+
Notes:
* The .NET Core version of the scanner does not support TFS XAML builds and automatic finding/conversion of Code Coverage files. Apart from that, all versions of the Scanner have the same capabilities and command line arguments.
Parameter|Description
---|---
-`/k:<project-key>`|[required] Specifies the key of the analyzed project in {instance}
-`/n:<project name>`|[optional] Specifies the name of the analyzed project in {instance}. Adding this argument will overwrite the project name in {instance} if it already exists.
+`/k:<project-key>`|[required] Specifies the key of the analyzed project in SonarQube
+`/n:<project name>`|[optional] Specifies the name of the analyzed project in SonarQube. Adding this argument will overwrite the project name in SonarQube if it already exists.
`/v:<version>`|[recommended] Specifies the version of your project.
-<!-- sonarcloud --> `/o:<organization>`|[required] Specifies the name of the target organization in SonarCloud. <!-- /sonarcloud -->
-`/d:sonar.login=<username> or <token>`| [optional] Specifies the username or access token to authenticate with to {instance}. If this argument is added to the begin step, it must also be added on the end step.
-`/d:sonar.password=<password>`|[optional] Specifies the password for the {instance} username in the `sonar.login` argument. This argument is not needed if you use authentication token. If this argument is added to the begin step, it must also be added on the end step.
+`/d:sonar.login=<token> or <username>`| [recommended] Specifies the [authentication token](/user-guide/user-token/) or username used to authenticate with to SonarQube. If this argument is added to the begin step, it must also be added to the end step.
+`/d:sonar.password=<password>`|[optional] Specifies the password for the SonarQube username in the `sonar.login` argument. This argument is not needed if you use authentication token. If this argument is added to the begin step, it must also be added on the end step.
`/d:sonar.verbose=true`|[optional] Sets the logging verbosity to detailed. Add this argument before sending logs for troubleshooting.
-`/d:<analysis-parameter>=<value>`|[optional] Specifies an additional {instance} [analysis parameter](/analysis/analysis-parameters/), you can add this argument multiple times.
+`/d:<analysis-parameter>=<value>`|[optional] Specifies an additional SonarQube [analysis parameter](/analysis/analysis-parameters/), you can add this argument multiple times.
For detailed information about all available parameters, see [Analysis Parameters](/analysis/analysis-parameters/).
[[warning]]
|  The "begin" step will modify your build like this:
-| * the active `CodeAnalysisRuleSet` will be updated to match the {instance} quality profile
+| * the active `CodeAnalysisRuleSet` will be updated to match the SonarQube quality profile
| * `WarningsAsErrors` will be turned off
|
-| If your build process cannot tolerate these changes we recommend creating a second build job for {instance} analysis.
+| If your build process cannot tolerate these changes we recommend creating a second build job for SonarQube analysis.
### Build
Between the `begin` and `end` steps, you need to build your project, execute tests and generate code coverage data. This part is specific to your needs and it is not detailed here.
### End
-The end step is executed when you add the "end" command line argument. It cleans the MSBuild/dotnet build hooks, collects the analysis data generated by the build, the test results, the code coverage and then uploads everything to {instance}
+The end step is executed when you add the "end" command line argument. It cleans the MSBuild/dotnet build hooks, collects the analysis data generated by the build, the test results, the code coverage and then uploads everything to SonarQube
There are only two additional arguments that are allowed for the end step:
Parameter|Description
---|---
-`/d:sonar.login=<username> or <token>`|[optional] This argument is required if it was added to the begin step.
+`/d:sonar.login=<token> or <username>`| This argument is required if it was added to the begin step.
`/d:sonar.password=<password>`|[optional] This argument is required if it was added to the begin step and you are not using an authentication token.
### Known Limitations
* Search for .trx files in any TestResults folder located under the $Build.SourcesDirectory path
* If not found, then a fallback search is made against $Agent.TempDirectory
-Once trx files have been found, their `.coverage` counterpart are searched as well and the scanner tries to convert them to `.coveragexml` files that will be uploaded to {instance}.
+Once trx files have been found, their `.coverage` counterpart are searched as well and the scanner tries to convert them to `.coveragexml` files that will be uploaded to SonarQube.
CodeCoverage.exe tool is used for that, and the scanner also needs to find a path to that tool, following this search path
* Search for the presence of `VsTestToolsInstallerInstalledToolLocation` environment variable, set by the VsTestToolsPlatformInstaller task or by the user
* If not found, search for either the presence of that tool in well-known installation path, or via the registry.
* [How to: Target a Version of the .NET Framework](https://msdn.microsoft.com/en-us/library/bb398202.aspx)
* [MSBuild Target Framework and Target Platform](https://msdn.microsoft.com/en-us/library/hh264221.aspx)
-If you do not want to switch your production build to MSBuild 14.0, you can set up a separate build dedicated to the {instance} analysis.
+If you do not want to switch your production build to MSBuild 14.0, you can set up a separate build dedicated to the SonarQube analysis.
**Detection of test projects**
The performance impact of this global installation for projects that aren't analyzed is negligible as this target is only a bootstrapper and will bail out nearly instantaneously when the `.sonarqube` folder is not found under the folder being built.
**Using SonarScanner for .NET with a Proxy**
-On build machines that connect to the Internet through a proxy server you might experience difficulties connecting to {instance}. To instruct the Java VM to use the system proxy settings, you need to set the following environment variable before running the SonarScanner for .NET:
+On build machines that connect to the Internet through a proxy server you might experience difficulties connecting to SonarQube. To instruct the Java VM to use the system proxy settings, you need to set the following environment variable before running the SonarScanner for .NET:
```bash
SONAR_SCANNER_OPTS = "-Djava.net.useSystemProxies=true"
```bash
SONAR_SCANNER_OPTS = "-Dhttp.proxyHost=yourProxyHost -Dhttp.proxyPort=yourProxyPort"
```
-Where _yourProxyHost_ and _yourProxyPort_ are the hostname and the port of your proxy server. There are additional proxy settings for https, authentication and exclusions that could be passed to the Java VM. For more information see the following article: https://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html.
+Where _yourProxyHost_ and _yourProxyPort_ are the hostname and the port of your proxy server. There are additional proxy settings for HTTPS, authentication and exclusions that could be passed to the Java VM. For more information see the following article: https://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html.
-Since version 5.0 of the scanner, HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY will be automatically recognized and use to make call against {instance}. The Scanner for .NET makes HTTP calls, independant from the settings above concerning the Java VM, to fetch the Quality Profile and other useful settings for the "end" step.
+Since version 5.0 of the scanner, HTTP_PROXY, HTTPS_PROXY, ALL_PROXY and NO_PROXY will be automatically recognized and use to make call against SonarQube. The Scanner for .NET makes HTTP calls, independant from the settings above concerning the Java VM, to fetch the Quality Profile and other useful settings for the "end" step.
-Where _yourProxyHost_ and _yourProxyPort_ are the hostname and the port of your proxy server. There are additional proxy settings for https, authentication and exclusions that could be passed to the Java VM. For more information see the following article: https://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html
+Where _yourProxyHost_ and _yourProxyPort_ are the hostname and the port of your proxy server. There are additional proxy settings for HTTPS, authentication and exclusions that could be passed to the Java VM. For more information see the following article: https://docs.oracle.com/javase/8/docs/technotes/guides/net/proxies.html
```
If you need more debug information, you can add one of the following to your command line: `-X`, `--verbose`, or `-Dsonar.verbose=true`.
-1. Run the following command from the project base directory to launch the analysis:
-`sonar-scanner`
+1. Run the following command from the project base directory to launch analysis and pass your [authentication token](/user-guide/user-token/):
+`sonar-scanner -Dsonar.login=myAuthenticationToken`
## Running SonarScanner from the Docker image
To scan using the SonarScanner Docker image, use the following command:
docker run \
--rm \
-e SONAR_HOST_URL="http://${SONARQUBE_URL}" \
+ -e SONAR_LOGIN="myAuthenticationToken" \
-v "${YOUR_REPO}:/usr/src" \
sonarsource/sonar-scanner-cli
```
| sonarsource/sonar-scanner-cli
| ```
| [[warning]]
-| |When running the container as a non-root user you have to make sure the user has read and write access to the directories you are mounting (like your source code or scanner cache directory), otherwise you may encounter permission related problems.
+| |When running the container as a non-root user you have to make sure the user has read and write access to the directories you are mounting (like your source code or scanner cache directory), otherwise you may encounter permission-related problems.
[[collapse]]
| ## Caching scanner files
```
export SONAR_SCANNER_OPTS="-Xmx512m"
```
-On Windows environments, avoid the double-quotes, since they get misinterpreted and combine the two parameters into a single one.
+In Windows environments, avoid the double-quotes, since they get misinterpreted and combine the two parameters into a single one.
```
set SONAR_SCANNER_OPTS=-Xmx512m
```
* administer a project (set exclusion patterns, tune plugin configuration for that project, etc.)
* administer Quality Profiles, Quality Gates, and the SonarQube instance itself.
-
Another aspect of security is the encryption of settings such as passwords. SonarQube provides a built-in mechanism to encrypt settings.
## Authentication
-The first question that should be answered when setting the security strategy for SonarQube is: Can anonymous users browse the SonarQube instance or is authentication be required?
-To force user authentication, log in as a system administrator, go to **[Administration > Configuration > General Settings > Security](/#sonarqube-admin#/admin/settings?category=security)**, and set the **Force user authentication** property to true.
+By default, SonarQube forces user authentication. You can disable forced user authentication, and allow anonymous users to browse projects and run analyses in your instance. To do this, log in as a system administrator, go to **[Administration > Configuration > General Settings > Security](/#sonarqube-admin#/admin/settings?category=security)**, and disable the **Force user authentication** property.
-[[info]]
-| SonarQube does not support sharing email addresses across multiple users.
+[[warning]]
+| Disabling the **Force user authentication** can expose your SonarQube instance to security risks. We strongly recommend forcing user authentication on production instances or carefully configuring the security (user permissions, project visibility, etc.) on your instance.
### API Endpoints Authentication
| * api/webservices/list
| * api/webservices/response_example
-It is advised to enable **Force user authentication** if you have your SonarQube instance publicly accessible.
+We advise keeping **Force user authentication** enabled if you have your SonarQube instance publicly accessible.
### Authentication Mechanisms
Authentication can be managed through a number of mechanisms:
```
## Authorization
-The way authorization is implemented in SonarQube is pretty standard. It is possible to create as many users and groups of users as needed. The users can then be attached (or not) to (multiple) groups. Groups and / or users are then given (multiple) permissions. The permissions grant access to projects, services and functionalities.
+The way authorization is implemented in SonarQube is pretty standard. It is possible to create as many users and groups of users as needed. The users can then be attached (or not) to (multiple) groups. Groups and/or users are then given (multiple) permissions. The permissions grant access to projects, services, and functionalities.
To administer groups and users, choose **Administration > Security**, and use the sub-menu items.
Two groups have a special meaning:
-* **Anyone** is a group that exists in the system, but that cannot be managed. Every user belongs to this group, including Anonymous user.
+* **Anyone** is a group that exists in the system, but that cannot be managed. Every user belongs to this group, including anonymous users.
* **sonar-users** is the default group to which users are automatically added.
### Global Permissions
* **Administer System**: All administration functions for the instance: global configuration.
* **Administer Quality Profiles**: Any action on Quality Profiles.
* **Administer Quality Gates**: Any action on quality gates
-* **Execute Analysis**: Execute analyses (project, view, report, developer), and to get all settings required to perform the analysis, even the secured ones like the scm account password, and so on.
+* **Execute Analysis**: Execute analyses (project, view, report, developer), and to get all settings required to perform the analysis, even the secured ones like the SCM account password, and so on.
* **Create Projects**: Initialize the structure of a new project before its first analysis. This permission is also required when doing the very first analysis of a project that has not already been created via the GUI. * **
* **Create Applications**: Create a new Application. * **
* **Create Portfolios**: Create a new Portfolio. * **
-\* Users with any explicit create permission will see a "+" item in the top menu giving access to these functions. If these permissions are removed from global administrators, they will loose quick access to them via the "+" menu, **but retain access to creation** via the **Administration** menu.
+\* Users with any explicit create permission will see a "+" item in the top menu giving access to these functions. If these permissions are removed from global administrators, they will lose quick access to them via the "+" menu, **but retain access to creation** via the **Administration** menu.
** Creating an item does not automatically grant rights to administer it. For that, see _Creators permission_ below.
* **Administer Issues**: Change the type and severity of issues, resolve issues as being "Won't Fix" or "False Positive" (users also need "Browse" permission).
* **Administer Security Hotspots**: Change the status of a Security Hotspot.
* **Administer**: Access project settings and perform administration tasks (users also need "Browse" permission).
-* **Execute Analysis**: Execute analyses (project, view, report, developer), and to get all settings required to perform the analysis, even the secured ones like the scm account password, the jira account password, and so on.
+* **Execute Analysis**: Execute analyses (project, view, report, developer), and to get all settings required to perform the analysis, even the secured ones like the SCM account password, the Jira account password, and so on.
Private projects have two additional permissions:
* **Browse**: Access a project; browse its measures, issues, and Security Hotspots; perform some issue edits (confirm/resolve/reopen, assignment, comment); comment on or change the user assigned to a Security Hotspot.
* **See Source Code**: View the project's source code.
-Note that permissions _are not_ cumulative. For instance, if you want to be able to administer the project, you also have to be granted the Browse permission to be able to access the project (which is the default for Public project).
+Note that permissions _are not_ cumulative. For instance, if you want to be able to administer the project, you also have to be granted the Browse permission to be able to access the project (which is the default for public projects).
You can either manually grant permissions for each project to some users and groups or apply permission templates to projects.
## Permission Templates for Default Permissions
-SonarQube ships with a default permissions template, which automatically grants specific permissions to certain groups when a project, portfolio, or application is created. It is possible to edit this template, and to create additional templates. A separate template can be set for each type of resource. Further, for projects you can have a template apply only to a subset of new projects using a project key regular expression (the template's **Project Key Pattern**). By default, every new project with a key that matches the supplied pattern will have template's permissions applied.
+SonarQube ships with a default permissions template, which automatically grants specific permissions to certain groups when a project, portfolio, or application is created. It is possible to edit this template and to create additional templates. A separate template can be set for each type of resource. Further, for projects, you can have a template apply only to a subset of new projects using a project key regular expression (the template's **Project Key Pattern**). By default, every new project with a key that matches the supplied pattern will have the template's permissions applied.
Templates are empty immediately after creation. Clicking on the template name will take you to its permission editing interface.
While templates can be applied after project creation, applying a template that includes "Creators" permissions to an existing project/portfolio/application will not grant the relevant permissions to the project's original creator because that association is not stored.
### Reset project permissions to a template
-To apply permission templates to projects go to **[Administration > Projects > Management](/#sonarqube-admin#/admin/projects_management)**. You can either apply a template to a specific project using the project-specific **Actions > Apply Permission Template** option or use the Bulk Apply Permission Template to apply a template to all selected projects.
+To apply permission templates to projects go to **[Administration > Projects > Management](/#sonarqube-admin#/admin/projects_management)**. You can either apply a template to a specific project using the project-specific **Actions > Apply Permission Template** option or use the Bulk Apply Permission Template to apply a template to all selected projects.
Note that there is no relation between a project and a permission template, meaning that:
* the permissions of a project can be modified after a permission template has been applied to this project
* none of the project permissions is changed when a permission template is modified
## Settings Encryption
-Encryption is mostly used to remove clear passwords from settings (database or SCM credentials for instance). The implemented solution is based on a symetric key algorithm. The key point is that the secret key is stored in a secured file on disk. This file must owned by and readable only by the system account that runs the SonarQube server.
+Encryption is mostly used to remove clear passwords from settings (database or SCM credentials for instance). The implemented solution is based on a symmetric key algorithm. The key point is that the secret key is stored in a secured file on disk. This file must be owned by and readable only by the system account that runs the SonarQube server.
The algorithm is AES 128 bits. Note that 256 bits cipher is not used because it's not supported by default on all Java Virtual Machines ([see this article](https://confluence.terena.org/display/~visser/No+256+bit+ciphers+for+Java+apps)).
1. **Generate the secret key**
A unique secret key must be shared between all parts of the SonarQube infrastructure. To generate it, go to **[Administration > Configuration > Encryption](/#sonarqube-admin#/admin/settings/encryption)** and click on Generate Secret Key.
1. **Store the secret key on the SonarQube server**
- * Copy the generated secred key to a file on the machine hosting the SonarQube server. The default location is _~/.sonar/sonar-secret.txt_. If you want to store it somewhere else, set its path through the `sonar.secretKeyPath` property in _$SONARQUBE-HOME/conf/sonar.properties_
+ * Copy the generated secret key to a file on the machine hosting the SonarQube server. The default location is _~/.sonar/sonar-secret.txt_. If you want to store it somewhere else, set its path through the `sonar.secretKeyPath` property in _$SONARQUBE-HOME/conf/sonar.properties_
* Restrict file permissions to the account running the SonarQube server (ownership and read-access only).
* Restart your SonarQube server
1. **Generate the encrypted values of your settings**
| ```
|
|  If your instance fails to start, check your [logs](/setup/troubleshooting/) to find the cause.
-|
-| 4. Log in to [http://localhost:9000](http://localhost:9000) using System Administrator credentials (login=admin, password=admin).
[[collapse]]
| ## From the Docker image
| ```console
| $ docker run -d --name sonarqube -e SONAR_ES_BOOTSTRAP_CHECKS_DISABLE=true -p 9000:9000 sonarqube:latest
| ```
-|
-| 2. Log in to [http://localhost:9000](http://localhost:9000) with System Administrator credentials (login=admin, password=admin).
+
+Once your instance is up and running, Log in to [http://localhost:9000](http://localhost:9000) using System Administrator credentials:
+- login: admin
+- password: admin
## Analyzing a Project
Now that you're logged in to your local SonarQube instance, let's analyze a project:
1. Click the **Create new project** button.
-1. When asked **How do you want to create your project**, select **Manually**.
-
1. Give your project a **Project key** and a **Display name** and click the **Set Up** button.
1. Under **Provide a token**, select **Generate a token**. Give your token a name, click the **Generate** button, and click **Continue**.
url: /user-guide/user-token/
---
-Each user can generate tokens that can be used to run analyses or invoke web services without access to the user's actual credentials.
+Users can generate tokens that can be used to run analyses or invoke web services without access to the user's actual credentials.
-## How to Generate a Token
+## Generating a token
-To generate a token, to go **User > My Account > Security**. Your existing tokens are listed here, each with a Revoke button.
+You can generate new tokens at **User > My Account > Security**.
The form at the bottom of the page allows you to generate new tokens. Once you click the **Generate** button, you will see the token value. Copy it immediately; once you dismiss the notification you will not be able to retrieve it.
-## How to Use a Token
+## Revoking a token
+
+You can revoke an existing token at **User > My Account > Security** by clicking the **Revoke** button next to the token.
+
+## Using a token
User tokens must replace your normal login process in the following scenarios:
-* when running analyses on your code: replace your login by the token in the `sonar.login` property.
+* when running analyses on your code: replace your login with the token in the `sonar.login` property.
* when invoking web services: just pass the token instead of your login while doing the basic authentication.
-In both cases, you don't need to provide a password (so when running analyses on your code, the property `sonar.password` is optional).
\ No newline at end of file
+In both cases, you don't need to provide a password (so when running analyses on your code, the property `sonar.password` is optional). Using a token is the preferred method over using a login and password.
\ No newline at end of file
projects / sonarqube.git / commitdiff