title: How to restrict SonarQube Execute Analysis permission per project?
body: <p>we are trying to setup our SonarQube server (5.6) so that anyone can run a Sonar analysis using Sonar Scanner and publish the results to the SonarQube. However, we want to restrict the users to publish the analysis only for certain project keys to prevent messing up existing project histories.</p>
  
  <p>We've played around with the permissions settings quite a bit. Let's say we have project key SomeProjectKey and a group SomeGroup. All analysis were published under user who is member of SomeGroup. The SomeGroup was granted all the permissions of SomeProjectKey except for Execute Analysis, which we tried to add and remove. The results can be seen in the matrix below:</p>
  
  <p><a href="https://i.stack.imgur.com/j3pvp.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/j3pvp.png" alt="enter image description here"></a></p>
  
  <p>Based on these results, it seems that granting the Execute Analysis (EA) on project level has no effect. It is required to have global EA to be able to publish the analysis. This, however, enables users with granted global EA to publish analysis for all projects. We haven't found any way how to restrict the publishing per project. The EA permission on project level seems completely redundant.</p>
  
  <p>Is there any way how to enable users publish analysis for only certain projects? More precisely, is there a way at all to allow users to publish analysis without granting them global EA?</p>
  
  <p>Thank you for any advice</p>
  
  <hr>
  
  <p>Edit:
  I turned the SonarQube log level to debug but still no clue. With global Execute Analysis granted, everything works fine and the log shows:</p>
  
  <pre><code>2016.08.19 17:13:42 DEBUG web[http] POST /api/ce/submit?projectKey=zz.yyy:xxx-exp&amp;projectName=xxx&amp;projectBranch=xxx | time=4279ms
  
  2016.08.19 17:13:43 INFO  ce[o.s.s.c.t.CeWorkerCallableImpl] Execute task | project=zz.yyy:xxx-exp&amp;projectName=xxx&amp;projectBranch=xxx | type=REPORT | id=AVajXWLL944EkuNYd4rD | submitter=pavel.sindelar
  
  2016.08.19 17:13:48 INFO  ce[o.s.s.c.t.CeWorkerCallableImpl] Executed task | project=zz.yyy:xxx-exp&amp;projectName=xxx&amp;projectBranch=xxx | type=REPORT | id=AVajXWLL944EkuNYd4rD | submitter=pavel.sindelar | time=4456ms
  </code></pre>
  
  <p>With Executed Analysis granted on the project level (all project permission granted), there is 403 HTTP status code with response body:</p>
  
  <pre><code>{"errors":[{"msg":"Insufficient privileges"}]}
  </code></pre>
  
  <p>The SonarQube log contains no info on what's wrong, there is just the line with the POST request being received, nothing more related to the anaylysis publishing, no error, nothing, even on trace level:</p>
  
  <pre><code>2016.08.22 10:15:57 DEBUG web[http] POST /api/ce/submit?projectKey=project=zz.yyy:xxx-exp&amp;projectName=xxx&amp;projectBranch=xxx | time=564ms
  </code></pre>
  
  <p>We will try to update to 6.0.</p>