SonarSource/sonarqube · error · IllegalArgumentException

allowAllGroups can only be enabled when Auto-provisioning is

Error message

allowAllGroups can only be enabled when Auto-provisioning is enabled.

What it means

allowAllGroups=true means every GitLab group feeds identity provisioning, which only makes sense when provisioningType is AUTO_PROVISIONING. GitlabConfigurationService.throwIfAllowAllGroupsAndJit rejects any configuration that enables allowAllGroups with a provisioning type other than AUTO_PROVISIONING (e.g. JIT or NONE).

Source

Thrown at server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java:254

    }

  }

  private void throwIfConfigurationAlreadyExists() {
    Optional.ofNullable(dbClient.propertiesDao().selectGlobalProperty(GITLAB_AUTH_ENABLED)).ifPresent(property -> {
      throw BadRequestException.create("GitLab configuration already exists. Only one Gitlab configuration is supported.");
    });
  }

  private static void throwIfInvalidAllowedGroupConfigurationAndAutoProvisioning(ProvisioningType provisioningType, Set<String> allowedGroups, boolean allowAllGroups) {
    if (provisioningType == AUTO_PROVISIONING && allowedGroups.isEmpty() && !allowAllGroups) {
      throw new IllegalArgumentException("allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false.");
    }
  }

  private static void throwIfAllowAllGroupsAndJit(ProvisioningType provisioningType, boolean allowAllGroups) {
    if (allowAllGroups && provisioningType != AUTO_PROVISIONING) {
      throw new IllegalArgumentException("allowAllGroups can only be enabled when Auto-provisioning is enabled.");
    }
  }

  private static void throwIfAllowAllGroupsAndGitlabCloud(String url, boolean allowAllGroups) {
    if (allowAllGroups && isGitlabCloudUrl(url)) {
      throw new IllegalArgumentException(
        "allowAllGroups cannot be enabled when the GitLab URL is gitlab.com (GitLab SaaS). "
          + "Use a self-managed GitLab instance, or restrict access via allowedGroups.");
    }
  }

  private static boolean shouldEnableAutoProvisioning(ProvisioningType provisioningType) {
    return AUTO_PROVISIONING.equals(provisioningType);
  }

  private void setProperty(DbSession dbSession, String propertyName, @Nullable String value) {
    dbClient.propertiesDao().saveProperty(dbSession, new PropertyDto().setKey(propertyName).setValue(value));
  }

View on GitHub (pinned to 184c821202)

Solutions

1. Set provisioningType=AUTO_PROVISIONING in the same request that enables allowAllGroups.
2. Set allowAllGroups=false if you intend to keep JIT or non-auto provisioning.

Example fix

// before
PUT /api/gitlab/configure?provisioningType=JIT&allowAllGroups=true

// after
PUT /api/gitlab/configure?provisioningType=AUTO_PROVISIONING&allowAllGroups=true

// client-side check
if (allowAllGroups && provisioningType != ProvisioningType.AUTO_PROVISIONING) {
  throw new IllegalArgumentException("allowAllGroups requires AUTO_PROVISIONING");
}

try { service.updateConfiguration(params); } catch (IllegalArgumentException e) { log.error("Config conflict: {}", e.getMessage()); }

When it happens

Trigger: createConfiguration/updateConfiguration called with allowAllGroups=true and provisioningType set to something other than AUTO_PROVISIONING (JIT_PROVISIONING or NONE).

Common situations: Admins toggle 'allow all groups' while their provisioning mode is just-in-time; import scripts copy the allowAllGroups flag between configs with different provisioning types.

Related errors

• allowedGroups cannot be empty when Auto-provisioning is enab
• Your Gitlab global configuration is incomplete. The GitLab U
• Your Gitlab global configuration is incomplete. The GitLab a
• allowAllGroups cannot be enabled when the GitLab URL is gitl
• Invalid Azure URL or Personal Access Token

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/bf214acc2a39a1c6. Report an issue: GitHub.