SonarSource/sonarqube · error · IllegalArgumentException

allowAllGroups cannot be enabled when the GitLab URL is gitl

Error message

allowAllGroups cannot be enabled when the GitLab URL is gitlab.com (GitLab SaaS). Use a self-managed GitLab instance, or restrict access via allowedGroups.

What it means

On GitLab SaaS (gitlab.com), SonarQube cannot enumerate all groups of the instance, so allowAllGroups is meaningless and unsupported there. throwIfAllowAllGroupsAndGitlabCloud detects a gitlab.com URL combined with allowAllGroups=true during createConfiguration/updateConfiguration and throws this IllegalArgumentException.

Source

Thrown at server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java:260

      throw BadRequestException.create("GitLab configuration already exists. Only one Gitlab configuration is supported.");
    });
  }

  private static void throwIfInvalidAllowedGroupConfigurationAndAutoProvisioning(ProvisioningType provisioningType, Set<String> allowedGroups, boolean allowAllGroups) {
    if (provisioningType == AUTO_PROVISIONING && allowedGroups.isEmpty() && !allowAllGroups) {
      throw new IllegalArgumentException("allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false.");
    }
  }

  private static void throwIfAllowAllGroupsAndJit(ProvisioningType provisioningType, boolean allowAllGroups) {
    if (allowAllGroups && provisioningType != AUTO_PROVISIONING) {
      throw new IllegalArgumentException("allowAllGroups can only be enabled when Auto-provisioning is enabled.");
    }
  }

  private static void throwIfAllowAllGroupsAndGitlabCloud(String url, boolean allowAllGroups) {
    if (allowAllGroups && isGitlabCloudUrl(url)) {
      throw new IllegalArgumentException(
        "allowAllGroups cannot be enabled when the GitLab URL is gitlab.com (GitLab SaaS). "
          + "Use a self-managed GitLab instance, or restrict access via allowedGroups.");
    }
  }

  private static boolean shouldEnableAutoProvisioning(ProvisioningType provisioningType) {
    return AUTO_PROVISIONING.equals(provisioningType);
  }

  private void setProperty(DbSession dbSession, String propertyName, @Nullable String value) {
    dbClient.propertiesDao().saveProperty(dbSession, new PropertyDto().setKey(propertyName).setValue(value));
  }

  private GitlabConfiguration getConfiguration(String id, DbSession dbSession) {
    throwIfNotUniqueConfigurationId(id);
    throwIfConfigurationDoesntExist(dbSession);
    return new GitlabConfiguration(
      UNIQUE_GITLAB_CONFIGURATION_ID,

View on GitHub (pinned to 184c821202)

Solutions

Set allowAllGroups=false and enumerate groups explicitly in allowedGroups.
Point the configuration at a self-managed GitLab instance if allowAllGroups is required.

Example fix

// before
url=https://gitlab.com, allowAllGroups=true

// after
url=https://gitlab.com, allowAllGroups=false, allowedGroups=my-org/my-group

Defensive patterns

Strategy: validation

Validate before calling

// before configure
boolean isCloud = url != null && java.net.URI.create(url).getHost() != null && java.net.URI.create(url).getHost().equals("gitlab.com");
if (isCloud && allowAllGroups) throw new IllegalArgumentException("allowAllGroups unsupported on gitlab.com");

Try / catch

try { service.createConfiguration(params); } catch (IllegalArgumentException e) { showHint("Use allowedGroups on GitLab SaaS"); }

Prevention

Check the host of the GitLab URL before enabling allowAllGroups.
Prefer explicit allowedGroups when targeting gitlab.com.

When it happens

Trigger: createConfiguration/updateConfiguration with a GitLab URL matching gitlab.com and allowAllGroups=true (typically with AUTO_PROVISIONING enabled).

Common situations: Configurations written for a self-managed GitLab are reused against gitlab.com; admins migrating from self-hosted to GitLab SaaS keep the allowAllGroups flag.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/490e583c7e066997. Report an issue: GitHub.