title: How do I hide Sonar database credentials from end users
body: <p>Attempted to ask this to user@sonar.codehaus.org but my email address appears to not be allowed to send to that list despite being subscribed.</p>
  
  <p>I'm trying to figure out how to put together a centralised, managed SonarQube service which would allow any developer to submit results to the service.</p>
  
  <p>All of the documentation for setting up SonarQube appears to state that users wanting to submit results should populate their configuration with something like the following:</p>
  
  <pre><code>        &lt;properties&gt;
              &lt;!-- ... snipped ... --&gt;
              &lt;sonar.jdbc.username&gt;sonar&lt;/sonar.jdbc.username&gt;
              &lt;sonar.jdbc.password&gt;sonar&lt;/sonar.jdbc.password&gt;
              &lt;sonar.host.url&gt;http://sonar-host:9000&lt;/sonar.host.url&gt;
              &lt;!-- ... snipped ... --&gt;
          &lt;/properties&gt;
  </code></pre>
  
  <p>For example:</p>
  
  <ul>
  <li><a href="http://docs.codehaus.org/display/SONAR/Installing+and+Configuring+Maven" rel="nofollow">http://docs.codehaus.org/display/SONAR/Installing+and+Configuring+Maven</a></li>
  <li><a href="http://docs.codehaus.org/display/SONAR/Installing+and+Configuring+SonarQube+Runner" rel="nofollow">http://docs.codehaus.org/display/SONAR/Installing+and+Configuring+SonarQube+Runner</a></li>
  </ul>
  
  <p>This would mean that any user wanting to update statistics would have access to a username/password for the main SonarQube database with full permission to query/update that database.</p>
  
  <p>Is the intention that SonarQube should be run as a centralised service which build administrators take code bases and build these on behalf of development teams or is there a way in which this function could be delegated to the teams directly?</p>
  
  <p>Cheers,</p>
  
  <p>David.</p>