SonarQube 9.x: Configuring API Token Expiration for Least-Privilege Users

Token Expiration and Role Enforcement

In SonarQube 9.x, API token expiration is a global instance setting. It cannot be configured on a per-user or per-group basis. Any token issued to a user—regardless of whether they hold a high-privilege Administrator role or a restricted Browse role—is subject to the same validity window. Once a token expires, the server returns a 401 Unauthorized response; there are no exemptions for least-privilege users.

Implementation Steps for Least-Privilege Tokens

To enforce token expiration and restrict access, follow these steps:

1. Configure Global Validity: Add the validity property to your sonar.properties file. Note that the exact property name may vary by sub-version (e.g., sonar.auth.token.maxAllowedValidity). A restart is required for this change to take effect.
2. Use Project Analysis Tokens: For CI/CD pipelines, avoid using personal user tokens. Issue Project Analysis Tokens. These are scoped specifically to the project they were created for, reducing the blast radius if a token is leaked.
3. Audit and Revoke: Since changing the global validity setting typically only affects newly created tokens, you must manually revoke and reissue existing tokens to bring them under the new expiration policy.

Verification and Audit Mechanisms

The ability to track token usage depends on your SonarQube edition:

• Community Edition: Monitor logs/access.log. Failed requests using expired or revoked tokens will appear as 401 HTTP responses. For deeper debugging, logs/web.log can be set to DEBUG level to see authentication failure details.
• Enterprise Edition and Above: Use the built-in Audit Logs to track specific events, such as when tokens are generated or revoked.

Technical Assumptions and Uncertainties

Scenario	Behavior	Confidence
User Deactivation	Tokens are invalidated immediately upon user deactivation.	High
Password Resets	Whether a password reset invalidates existing tokens is unverified.	Low
Version Support	Token TTL was introduced mid-9.x; versions prior to ~9.7 may not support expiration properties.	Medium

Required Diagnostic: Please provide your exact SonarQube version (e.g., 9.9 LTS) and Edition (Community, Developer, Enterprise), as the available audit logs and the specific property name for token validity differ across these versions.