{"record":{"id":"58cc4c3d6a5c7276","repo":"SonarSource/sonarqube","slug":"you-are-not-allowed-to-authenticate","errorCode":null,"errorMessage":"You are not allowed to authenticate","messagePattern":"You are not allowed to authenticate","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":403,"severity":"error","filePath":"server/sonar-auth-gitlab/src/main/java/org/sonar/auth/gitlab/GitLabIdentityProvider.java","lineNumber":157,"sourceCode":"      Set<String> userGroups = getGroups(accessToken);\n      validateUserInAllowedGroups(user.getUsername(), userGroups);\n      builder.setGroups(userGroups);\n    }\n    context.authenticate(builder.build());\n    context.redirectToRequestedPage();\n  }\n\n  private void validateUserInAllowedGroups(String gitlabUserName, Set<String> userGroups) {\n    if (gitLabSettings.allowedGroups().isEmpty() || gitLabSettings.allowAllGroups()) {\n      return;\n    }\n\n    boolean allowedUser = userGroups.stream()\n      .anyMatch(gitLabSettings::isAllowedGroup);\n\n    if (!allowedUser) {\n      LOG.info(\"Login for user with GitLab user name {} rejected, as the user do not belong to the allowlisted groups\", gitlabUserName);\n      throw new UnauthorizedException(\"You are not allowed to authenticate\");\n    }\n  }\n\n  private Set<String> getGroups(OAuth2AccessToken accessToken) {\n    Set<String> allowedGroups = gitLabSettings.allowedGroups();\n    List<GsonGroup> groups;\n    if (allowedGroups.isEmpty() || gitLabSettings.allowAllGroups() || hasShortGroupName(allowedGroups)) {\n      // GitLab GraphQL API requires a minimum of 3 characters for group search queries.\n      // When any allowed group name is shorter than 3 characters, targeted search cannot\n      // be used, so all user groups are fetched and filtered client-side instead.\n      groups = gitLabGraphQlClient.getGroups(accessToken.getAccessToken(), null);\n    } else {\n      groups = findGroupsUsingGraphQlApiInParallel(accessToken, allowedGroups);\n    }\n    return groups.stream()\n      .map(GsonGroup::getFullPath)\n      .collect(toSet());\n  }","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-auth-gitlab/src/main/java/org/sonar/auth/gitlab/GitLabIdentityProvider.java#L139-L175","documentation":"Thrown by GitLabIdentityProvider.validateUserInAllowedGroups when the authenticated user's GitLab groups contain none of the configured allowed groups. It is an UnauthorizedException: the login succeeded against GitLab but is rejected by group allowlisting policy. The reason is logged server-side before throwing.","triggerScenarios":"onCallback -> validateUserInAllowedGroups: getGroups(accessToken) returns the user's groups, and userGroups.stream().anyMatch(gitLabSettings::isAllowedGroup) is false — no overlap with sonar.auth.gitlab.allowed-groups.","commonSituations":"Admin configured full group paths (e.g. my-org/my-team) while matching logic expects bare slugs or vice versa; user recently removed from the group; allowed group exists in a different GitLab instance/namespace; group renamed after configuration.","solutions":["Verify the sonar.auth.gitlab.allowed-groups values exactly match the group paths/names returned by the GitLab API for the user.","Confirm the user is (still) a member of at least one allowed group in GitLab.","Check server logs for the 'rejected, as the user do not belong to the allowlisted groups' line and compare the returned group list.","Update configuration after any group rename or reorganization in GitLab."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Compare the user's GitLab groups to the allowlist before login completes\nSet<String> allowed = new HashSet<>(Arrays.asList(gitLabSettings.allowedGroups()));\nallowed.retainAll(userGroups); // empty result means the login will be rejected","typeGuard":null,"tryCatchPattern":"try {\n    validateUserInAllowedGroups(accessToken, gitlabUserName);\n} catch (UnauthorizedException e) {\n    LOG.warn(\"GitLab group allowlist rejected user {}: {}\", gitlabUserName, e.getMessage());\n}","preventionTips":["Match group path format exactly as the GitLab API returns it (full path vs slug).","Re-check allowlisted groups after renames/reorganizations in GitLab.","Review server logs (rejected login line) when users report access issues."],"tags":["oauth","gitlab","authorization","group-restriction"],"backgroundTag":"permission-denied","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}