How do I hide Sonar database credentials from end

Question

Attempted to ask this to [e-mail] but my email address appears to not be allowed to send to that list despite being subscribed.

I'm trying to figure out how to put together a centralised, managed SonarQube service which would allow any developer to submit results to the service.

All of the documentation for setting up SonarQube appears to state that users wanting to submit results should populate their configuration with something like the following:

        <properties>
            <!-- ... snipped ... -->
            <sonar.jdbc.username>sonar</sonar.jdbc.username>
            <sonar.jdbc.password>sonar</sonar.jdbc.password>
            <sonar.host.url>http://sonar-host:9000</sonar.host.url>
            <!-- ... snipped ... -->
        </properties>

For example:

• http://docs.codehaus.org/display/SONAR/Installing+and+Configuring+Maven
• http://docs.codehaus.org/display/SONAR/Installing+and+Configuring+SonarQube+Runner

This would mean that any user wanting to update statistics would have access to a username/password for the main SonarQube database with full permission to query/update that database.

Is the intention that SonarQube should be run as a centralised service which build administrators take code bases and build these on behalf of development teams or is there a way in which this function could be delegated to the teams directly?

Cheers,

David.

Answer 1

You can setup Settings Encryption to encrypt settings if they are meant to be distributed. Note that most of the times, the RDBM login and password are only known on the machine responsible for analysis, which is often a continuous integration system.