SonarSource/sonarqube · error · IllegalArgumentException

allowedGroups cannot be empty when Auto-provisioning is enab

Error message

allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false.

What it means

GitLab auto-provisioning in SonarQube derives permissions from GitLab group membership. When provisioningType is AUTO_PROVISIONING, the configuration must either list explicit allowedGroups or set allowAllGroups=true; otherwise no users would ever be provisioned. GitlabConfigurationService throws this IllegalArgumentException from createConfiguration/updateConfiguration when allowedGroups is empty and allowAllGroups is false.

Source

Thrown at server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java:248

      if (enableAutoProvisioning) {
        triggerRun(configuration);
      }
      GitlabConfiguration createdConfiguration = getConfiguration(UNIQUE_GITLAB_CONFIGURATION_ID, dbSession);
      dbSession.commit();
      return createdConfiguration;
    }

  }

  private void throwIfConfigurationAlreadyExists() {
    Optional.ofNullable(dbClient.propertiesDao().selectGlobalProperty(GITLAB_AUTH_ENABLED)).ifPresent(property -> {
      throw BadRequestException.create("GitLab configuration already exists. Only one Gitlab configuration is supported.");
    });
  }

  private static void throwIfInvalidAllowedGroupConfigurationAndAutoProvisioning(ProvisioningType provisioningType, Set<String> allowedGroups, boolean allowAllGroups) {
    if (provisioningType == AUTO_PROVISIONING && allowedGroups.isEmpty() && !allowAllGroups) {
      throw new IllegalArgumentException("allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false.");
    }
  }

  private static void throwIfAllowAllGroupsAndJit(ProvisioningType provisioningType, boolean allowAllGroups) {
    if (allowAllGroups && provisioningType != AUTO_PROVISIONING) {
      throw new IllegalArgumentException("allowAllGroups can only be enabled when Auto-provisioning is enabled.");
    }
  }

  private static void throwIfAllowAllGroupsAndGitlabCloud(String url, boolean allowAllGroups) {
    if (allowAllGroups && isGitlabCloudUrl(url)) {
      throw new IllegalArgumentException(
        "allowAllGroups cannot be enabled when the GitLab URL is gitlab.com (GitLab SaaS). "
          + "Use a self-managed GitLab instance, or restrict access via allowedGroups.");
    }
  }

  private static boolean shouldEnableAutoProvisioning(ProvisioningType provisioningType) {

View on GitHub (pinned to 184c821202)

Solutions

Add at least one GitLab group to the allowedGroups list in the GitLab provisioning configuration.
Set allowAllGroups=true if all groups on the instance should be allowed.
Switch provisioningType to a non-auto-provisioning mode if group-based auto-provisioning is not intended.

Example fix

// before
PUT /api/gitlab/configure?provisioningType=AUTO_PROVISIONING&allowAllGroups=false&allowedGroups=

// after
PUT /api/gitlab/configure?provisioningType=AUTO_PROVISIONING&allowAllGroups=false&allowedGroups=my-group

Defensive patterns

Strategy: validation

Validate before calling

// before calling createConfiguration/updateConfiguration
if (provisioningType == ProvisioningType.AUTO_PROVISIONING && !allowAllGroups && (allowedGroups == null || allowedGroups.isEmpty())) {
  throw new IllegalArgumentException("Provide allowedGroups or set allowAllGroups=true");
}

Try / catch

try { service.createConfiguration(params); } catch (IllegalArgumentException e) { log.error("Invalid GitLab provisioning config: {}", e.getMessage()); }

Prevention

Always populate allowedGroups when enabling AUTO_PROVISIONING with allowAllGroups=false.
Validate the group list is non-empty in the UI before submit.

When it happens

Trigger: Calling POST/PUT api/gitlab/configure (createConfiguration/updateConfiguration) with provisioningType=AUTO_PROVISIONING, allowAllGroups=false, and an empty allowedGroups set.

Common situations: Admins enable auto-provisioning but forget to add any GitLab groups; a UI or script sends an empty groups array; groups were removed and the config is saved again without replacements.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/baa14fb71692e9f6. Report an issue: GitHub.