{"record":{"id":"490e583c7e066997","repo":"SonarSource/sonarqube","slug":"allowallgroups-cannot-be-enabled-when-the-gitlab-u","errorCode":null,"errorMessage":"allowAllGroups cannot be enabled when the GitLab URL is gitlab.com (GitLab SaaS). Use a self-managed GitLab instance, or restrict access via allowedGroups.","messagePattern":"allowAllGroups cannot be enabled when the GitLab URL is gitlab\\.com \\(GitLab SaaS\\)\\. Use a self-managed GitLab instance, or restrict access via allowedGroups\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java","lineNumber":260,"sourceCode":"      throw BadRequestException.create(\"GitLab configuration already exists. Only one Gitlab configuration is supported.\");\n    });\n  }\n\n  private static void throwIfInvalidAllowedGroupConfigurationAndAutoProvisioning(ProvisioningType provisioningType, Set<String> allowedGroups, boolean allowAllGroups) {\n    if (provisioningType == AUTO_PROVISIONING && allowedGroups.isEmpty() && !allowAllGroups) {\n      throw new IllegalArgumentException(\"allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false.\");\n    }\n  }\n\n  private static void throwIfAllowAllGroupsAndJit(ProvisioningType provisioningType, boolean allowAllGroups) {\n    if (allowAllGroups && provisioningType != AUTO_PROVISIONING) {\n      throw new IllegalArgumentException(\"allowAllGroups can only be enabled when Auto-provisioning is enabled.\");\n    }\n  }\n\n  private static void throwIfAllowAllGroupsAndGitlabCloud(String url, boolean allowAllGroups) {\n    if (allowAllGroups && isGitlabCloudUrl(url)) {\n      throw new IllegalArgumentException(\n        \"allowAllGroups cannot be enabled when the GitLab URL is gitlab.com (GitLab SaaS). \"\n          + \"Use a self-managed GitLab instance, or restrict access via allowedGroups.\");\n    }\n  }\n\n  private static boolean shouldEnableAutoProvisioning(ProvisioningType provisioningType) {\n    return AUTO_PROVISIONING.equals(provisioningType);\n  }\n\n  private void setProperty(DbSession dbSession, String propertyName, @Nullable String value) {\n    dbClient.propertiesDao().saveProperty(dbSession, new PropertyDto().setKey(propertyName).setValue(value));\n  }\n\n  private GitlabConfiguration getConfiguration(String id, DbSession dbSession) {\n    throwIfNotUniqueConfigurationId(id);\n    throwIfConfigurationDoesntExist(dbSession);\n    return new GitlabConfiguration(\n      UNIQUE_GITLAB_CONFIGURATION_ID,","sourceCodeStart":242,"sourceCodeEnd":278,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java#L242-L278","documentation":"On GitLab SaaS (gitlab.com), SonarQube cannot enumerate all groups of the instance, so allowAllGroups is meaningless and unsupported there. throwIfAllowAllGroupsAndGitlabCloud detects a gitlab.com URL combined with allowAllGroups=true during createConfiguration/updateConfiguration and throws this IllegalArgumentException.","triggerScenarios":"createConfiguration/updateConfiguration with a GitLab URL matching gitlab.com and allowAllGroups=true (typically with AUTO_PROVISIONING enabled).","commonSituations":"Configurations written for a self-managed GitLab are reused against gitlab.com; admins migrating from self-hosted to GitLab SaaS keep the allowAllGroups flag.","solutions":["Set allowAllGroups=false and enumerate groups explicitly in allowedGroups.","Point the configuration at a self-managed GitLab instance if allowAllGroups is required."],"exampleFix":"// before\nurl=https://gitlab.com, allowAllGroups=true\n\n// after\nurl=https://gitlab.com, allowAllGroups=false, allowedGroups=my-org/my-group","handlingStrategy":"validation","validationCode":"// before configure\nboolean isCloud = url != null && java.net.URI.create(url).getHost() != null && java.net.URI.create(url).getHost().equals(\"gitlab.com\");\nif (isCloud && allowAllGroups) throw new IllegalArgumentException(\"allowAllGroups unsupported on gitlab.com\");","typeGuard":null,"tryCatchPattern":"try { service.createConfiguration(params); } catch (IllegalArgumentException e) { showHint(\"Use allowedGroups on GitLab SaaS\"); }","preventionTips":["Check the host of the GitLab URL before enabling allowAllGroups.","Prefer explicit allowedGroups when targeting gitlab.com."],"tags":["gitlab","gitlab-saas","configuration","validation"],"backgroundTag":"conflicting-config-options","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}