Access Control and Permissions in Sonatype Firewall Enterprise

Firewall Enterprise uses the same roles and permissions as the rest of Sonatype IQ Server. What is specific to Firewall Enterprise is where you assign them: Policy Gateways live in their own place in the organization hierarchy, and several Firewall Enterprise permissions must be held on that container rather than on an individual Policy Gateway.

This page covers the hierarchy, the scopes available, the permission each task needs, and the accounts your repository manager and CI systems use.

You manage Firewall Enterprise access in the Repository Firewall UI. Lifecycle is not required. Without Lifecycle, Repos and Policies provides access to the Root Organization, the Policy Gateways container, and individual Policy Gateways. Lifecycle sub-organizations and applications are not part of the Policy Gateway hierarchy, and their roles and policies do not apply to Policy Gateways.

Get Access to Firewall Enterprise

For Firewall Enterprise Cloud, organizations and identity-provider connections are managed through my.sonatype.com. Firewall Enterprise roles are assigned in the Firewall Enterprise UI under Repos and Policies > Access.

For Firewall Enterprise Cloud, how users gain access depends on the configured identity provider:

When your organization uses the Sonatype identity provider, a System Administrator invites users under System Preferences > Users > Invite User.
When your organization uses its own identity provider, users sign in with their company credentials. Configure the identity-provider connection through my.sonatype.com.

For self-hosted IQ Server, add users under System Preferences > Users or configure an external authentication source.

After a user signs in, assign the required Firewall Enterprise role under Repos and Policies > Access.

Assign a Role at the Root Organization

A role assigned at the Root Organization is inherited by the Policy Gateways container and every Policy Gateway.

To assign a role:

Open Repos and Policies.
Select Root Organization. This option appears when your account has access to it.
Open Access.
Select Add a Role.
Select the required role.
Add the users or groups to Associated Members.
Select Create.

Assign a Role at the Policy Gateway or Policy Gateway Container Level

Open Repos and Policies.
Select the main level Policy Gateways option to manage access at the Policy Gateway container level. Or, select an individual Policy Gateway to manage access for an individual gateway.
Open the Access section.
Select Add a Role to either add a new role or manage members of an existing role.

Roles are inherited downward. A role granted at the Root Organization reaches the Policy Gateways container and every Policy Gateway; a role granted on the container reaches every Policy Gateway. Roles are not inherited upward: a role on one Policy Gateway grants nothing at the container.

Assign a Role at the Global Level

Roles assigned under System Preferences > Administrators are global administrator roles.

To assign a global administrator role:

Select the gear icon to open System Preferences.
Select Administrators.
Under Configure Administrators, select System Administrator or Policy Administrator.
Under Add Members, use Search Users and Groups to find a user or group. The * wildcard is supported (e.g., Isa* matches Isaac Asimov).
To add a group from an external identity provider, select Add an External Group and enter the exact group name.
Save your changes.

The Policy Administrator role includes the IQ permissions required to configure and manage Firewall Enterprise.

The System Administrator role manages system configuration and users. It does not include View IQ Elements, Edit IQ Elements, or Evaluate Individual Components. A user with only the System Administrator role cannot create a Policy Gateway, and this role is not appropriate for the repository-manager service account.

Roles such as Component Evaluator, Owner, and Developer are assigned under Repos and Policies > Access, not under Configure Administrators.

With a Firewall Enterprise license, Configure Administrators includes System Administrator and Policy Administrator. Additional global roles can appear when other licensed products are enabled. For example, Agent P Administrator appears when the license also includes AI Developer.

Managing global administrators requires the Edit system configuration and users permission. When a role should apply only to Firewall Enterprise, assign it at the Root Organization, on the Policy Gateways container, or on an individual Policy Gateway.

Create a Service Account for the Repository Manager

Use a dedicated service account for the repository manager instead of a personal user account.

Create or invite the service-account user.
Complete the account’s initial sign-in and multi-factor authentication when required.
Assign the Component Evaluator role to the service account on the Policy Gateways container.
Sign in as the service-account user.
Select the profile icon.
Select Manage User Token.
Select Generate User Token.
Store the user code and passcode in your approved secrets manager.

A Component Evaluator role assigned at the Root Organization also satisfies the permission check but grants broader inherited access than the repository manager requires. Use the Policy Gateways container for the service account unless the account intentionally requires the broader scope.

Only the account that owns a user token can generate it. An administrator cannot generate a token for another user.

A Component Evaluator role assigned only to an individual Policy Gateway is not sufficient for a repository-manager service account because repository-manager authentication is checked at the Policy Gateways container.

Roles and Permissions Quick Reference

The table below outlines common actions you will wish to perform with Firewall Enterprise, the permissions needed to perform those actions, and the built-in roles that include those permissions.

Action	Permission Needed	Built-in Roles that Include it
View Policy Gateway Results	View IQ Elements	Developer, Owner, Policy Administrator
Re-evaluate a Policy Gateway or a component	Evaluate Individual Components	Component Evaluator, Developer, Owner, Policy Administrator
Add a waiver or bulk waiver	Waive Policy Violations	Owner, Policy Administrator
Release a component from quarantine	Edit IQ Elements	Owner, Policy Administrator