User accounts

Security-relevant considerations and setups regarding user accounts.

By default, authentication is forced.

Authentication can be managed:

• Via the SonarQube Community Build built-in users/groups database. See Creating users manually
• Via several delegated authentication methods, see the Overview of authentication and provisioning section for more information.

To change the password of a manually created account, see Changing user password.

To deactivate a user account, see Deactivating users.

To manage the user account permissions, see:

• Managing permissions

• Setting project permissions

Disabling forced user authentication

You can disable forced user authentication, and allow anonymous users to browse public projects in your instance. To do so, you need the Administer System permission.

Anonymous users cannot run analyses, regardless of this setting, because the Execute Analysis permission can no longer be granted to them. This changed in SonarQube Community Build 26.10, when the Anyone group was removed. For more information, see the Update notes.

Disabling forced authentication can expose your SonarQube Community Build instance to security risks. We strongly recommend forcing user authentication on production instances or carefully configuring the security (user permissions, project visibility, etc.) on your instance. See also Accessible API endpoints if forced authentication disabled.

We advise keeping forced authentication if you have your SonarQube Community Build instance publicly accessible.

Accessible API endpoints if forced authentication disabled

If forced authentication is disabled, the following API endpoints are accessible without authentication:

• api/components/search
• api/issues/tags
• api/languages/list
• api/metrics/domains
• api/metrics/search
• api/metrics/types
• api/plugins/installed
• api/project_tags/search
• api/qualitygates/list
• api/qualitygates/search
• api/qualitygates/show
• api/qualityprofiles/backup
• api/qualityprofiles/changelog
• api/qualityprofiles/export
• api/qualityprofiles/exporters
• api/qualityprofiles/importers
• api/qualityprofiles/inheritance
• api/qualityprofiles/projects
• api/qualityprofiles/search
• api/rules/repositories
• api/rules/search
• api/rules/show
• api/rules/tags
• api/server/version
• api/settings/login_message
• api/sources/scm (for public repositories)
• api/sources/show (for public repositories)
• api/system/dbmigrationstatus
• api/system/migrate_db
• api/system/ping
• api/system/status
• api/system/upgrades
• api/users/search
• api/webservices/list
• api/webservices/response_example

To disable forced authentication:

1. Go to Administration > Configuration > General settings > Security.
2. Disable Force user authentication.