SonarQube

Requirements

• SonarQube Community
• sonar-auth-oidc plugin v3.0.0 or later
• HTTPS connection to your SonarQube instance

Create the client in Pocket ID

1. In Pocket ID, open Administration → OIDC Clients and click Add OIDC Client.
2. Enter a name such as SonarQube and add the callback URL https://sonarqube.example.com/oauth2/callback/oidc.
3. Click Create and copy the Client ID, the Client secret and the OIDC Discovery URL. The client secret is only shown once.
4. On the client’s Access tab, select the groups that may sign in under Allowed User Groups, or choose All Users.

Configure SonarQube

1. Download sonar-auth-oidc v3.0.0 or later and copy it into the SonarQube plugins directory, usually /opt/sonarqube/extensions/plugins.
2. Restart SonarQube.
3. In SonarQube, open Administration → Configuration → Security and set the following parameters:
   • Enabled: checked
   • Issuer URI: https://id.example.com (the OIDC Discovery URL from Pocket ID without /.well-known/openid-configuration)
   • Client ID: the Client ID from Pocket ID
   • Client secret: the Client secret from Pocket ID
   • Scopes: openid email profile groups
   • Allow users to sign-up: checked (optional but recommended)
   • Login generation strategy: Email

Control admin access with groups

To control admin access to SonarQube with Pocket ID groups:

1. In Pocket ID, open Administration → User Groups and click Add Group to create the group.
2. On the group’s page, add a custom claim under Custom Claims that matches the SonarQube admin group. The value must be a JSON array.
   • Key: sonargroups
   • Value: ["sonar-administrators"]
3. In SonarQube, open Administration → Configuration → Security and set:
   • Synchronize groups: checked
   • Groups claim name: sonargroups

SonarQube then automatically adds the members of the Pocket ID group to the SonarQube sonar-administrators group.

Additional information

More information about sonar-auth-oidc can be found in its configuration documentation.

With Pocket ID Custom Claims, you can manage SonarQube groups entirely from Pocket ID.