{"record":{"id":"baa14fb71692e9f6","repo":"SonarSource/sonarqube","slug":"allowedgroups-cannot-be-empty-when-auto-provisioni","errorCode":null,"errorMessage":"allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false.","messagePattern":"allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java","lineNumber":248,"sourceCode":"      if (enableAutoProvisioning) {\n        triggerRun(configuration);\n      }\n      GitlabConfiguration createdConfiguration = getConfiguration(UNIQUE_GITLAB_CONFIGURATION_ID, dbSession);\n      dbSession.commit();\n      return createdConfiguration;\n    }\n\n  }\n\n  private void throwIfConfigurationAlreadyExists() {\n    Optional.ofNullable(dbClient.propertiesDao().selectGlobalProperty(GITLAB_AUTH_ENABLED)).ifPresent(property -> {\n      throw BadRequestException.create(\"GitLab configuration already exists. Only one Gitlab configuration is supported.\");\n    });\n  }\n\n  private static void throwIfInvalidAllowedGroupConfigurationAndAutoProvisioning(ProvisioningType provisioningType, Set<String> allowedGroups, boolean allowAllGroups) {\n    if (provisioningType == AUTO_PROVISIONING && allowedGroups.isEmpty() && !allowAllGroups) {\n      throw new IllegalArgumentException(\"allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false.\");\n    }\n  }\n\n  private static void throwIfAllowAllGroupsAndJit(ProvisioningType provisioningType, boolean allowAllGroups) {\n    if (allowAllGroups && provisioningType != AUTO_PROVISIONING) {\n      throw new IllegalArgumentException(\"allowAllGroups can only be enabled when Auto-provisioning is enabled.\");\n    }\n  }\n\n  private static void throwIfAllowAllGroupsAndGitlabCloud(String url, boolean allowAllGroups) {\n    if (allowAllGroups && isGitlabCloudUrl(url)) {\n      throw new IllegalArgumentException(\n        \"allowAllGroups cannot be enabled when the GitLab URL is gitlab.com (GitLab SaaS). \"\n          + \"Use a self-managed GitLab instance, or restrict access via allowedGroups.\");\n    }\n  }\n\n  private static boolean shouldEnableAutoProvisioning(ProvisioningType provisioningType) {","sourceCodeStart":230,"sourceCodeEnd":266,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java#L230-L266","documentation":"GitLab auto-provisioning in SonarQube derives permissions from GitLab group membership. When provisioningType is AUTO_PROVISIONING, the configuration must either list explicit allowedGroups or set allowAllGroups=true; otherwise no users would ever be provisioned. GitlabConfigurationService throws this IllegalArgumentException from createConfiguration/updateConfiguration when allowedGroups is empty and allowAllGroups is false.","triggerScenarios":"Calling POST/PUT api/gitlab/configure (createConfiguration/updateConfiguration) with provisioningType=AUTO_PROVISIONING, allowAllGroups=false, and an empty allowedGroups set.","commonSituations":"Admins enable auto-provisioning but forget to add any GitLab groups; a UI or script sends an empty groups array; groups were removed and the config is saved again without replacements.","solutions":["Add at least one GitLab group to the allowedGroups list in the GitLab provisioning configuration.","Set allowAllGroups=true if all groups on the instance should be allowed.","Switch provisioningType to a non-auto-provisioning mode if group-based auto-provisioning is not intended."],"exampleFix":"// before\nPUT /api/gitlab/configure?provisioningType=AUTO_PROVISIONING&allowAllGroups=false&allowedGroups=\n\n// after\nPUT /api/gitlab/configure?provisioningType=AUTO_PROVISIONING&allowAllGroups=false&allowedGroups=my-group","handlingStrategy":"validation","validationCode":"// before calling createConfiguration/updateConfiguration\nif (provisioningType == ProvisioningType.AUTO_PROVISIONING && !allowAllGroups && (allowedGroups == null || allowedGroups.isEmpty())) {\n  throw new IllegalArgumentException(\"Provide allowedGroups or set allowAllGroups=true\");\n}","typeGuard":null,"tryCatchPattern":"try { service.createConfiguration(params); } catch (IllegalArgumentException e) { log.error(\"Invalid GitLab provisioning config: {}\", e.getMessage()); }","preventionTips":["Always populate allowedGroups when enabling AUTO_PROVISIONING with allowAllGroups=false.","Validate the group list is non-empty in the UI before submit."],"tags":["gitlab","configuration","validation","auto-provisioning"],"backgroundTag":"conflicting-config-options","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}