What causes "Failed to get gitlab user" in SonarSource/sonarqube?

Inspect the chained IOException cause to determine whether it is DNS, connect, TLS, or read failure.

SonarSource/sonarqube · error · IllegalStateException

Failed to get gitlab user

Error message

Failed to get gitlab user

What it means

Thrown by GitLabRestClient.getUser when the HTTP call to the GitLab /user endpoint throws an IOException during request execution or body reading. The IllegalStateException wraps the IOException as its cause, indicating a transport-level failure rather than an API rejection (non-2xx responses are handled elsewhere).

Solutions

Inspect the chained IOException cause to determine whether it is DNS, connect, TLS, or read failure.
Verify sonar.auth.gitlab.url points to the correct GitLab base URL reachable from the SonarQube server (test with curl).
For self-signed GitLab instances, import the certificate into the JVM truststore used by SonarQube.
Check proxy settings and GitLab instance health; retry after transient outages.

Example fix

// before
sonar.auth.gitlab.url=https://gitlab.example.internal
// after (correct scheme/host reachable from SonarQube, cert imported)
sonar.auth.gitlab.url=https://gitlab.example.internal
// and: keytool -importcert -alias gitlab -file gitlab.crt -keystore $JAVA_HOME/lib/security/cacerts

Defensive patterns

Strategy: retry

Validate before calling

// Verify GitLab reachability from the SonarQube host before login
HttpURLConnection c = (HttpURLConnection) new URL(gitLabSettings.apiUrl() + "/user").openConnection();
c.setConnectTimeout(3000);

Try / catch

try {
    GsonUser user = gitLabRestClient.getUser(scribe, accessToken);
} catch (IllegalStateException e) {
    if (e.getCause() instanceof IOException io) {
        LOG.warn("GitLab unreachable: {} — retry or check network/TLS", io.getMessage());
    }
}

Prevention

Verify sonar.auth.gitlab.url is correct and reachable from the server (curl test).
Import self-signed GitLab certificates into the JVM truststore.
Configure proxy settings if the GitLab instance is behind a proxy.

When it happens

Trigger: getUser(scribe, accessToken) executes OAuthRestClient.executeRequest(gitLabSettings.apiUrl() + "/user", ...) and the underlying HTTP client throws IOException — connection failure, timeout, TLS handshake error, or a broken response stream.

Common situations: Wrong sonar.auth.gitlab.url (pointing at the wrong host or missing /api prefix scheme); GitLab instance unreachable due to firewall/proxy; self-signed certificate not trusted by SonarQube's JVM; GitLab briefly down during maintenance.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/43aea400a9fad8cb. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-auth-gitlab/src/main/java/org/sonar/auth/gitlab/GitLabRestClient.java:41

import com.github.scribejava.core.model.Response;
import com.github.scribejava.core.oauth.OAuth20Service;
import java.io.IOException;
import org.sonar.auth.OAuthRestClient;

public class GitLabRestClient {

  private final GitLabSettings gitLabSettings;

  public GitLabRestClient(GitLabSettings gitLabSettings) {
    this.gitLabSettings = gitLabSettings;
  }

  GsonUser getUser(OAuth20Service scribe, OAuth2AccessToken accessToken) {
    try (Response response = OAuthRestClient.executeRequest(gitLabSettings.apiUrl() + "/user", scribe, accessToken)) {
      String responseBody = response.getBody();
      return GsonUser.parse(responseBody);
    } catch (IOException e) {
      throw new IllegalStateException("Failed to get gitlab user", e);
    }
  }
}

View on GitHub (pinned to 184c821202)