{"record":{"id":"bf214acc2a39a1c6","repo":"SonarSource/sonarqube","slug":"allowallgroups-can-only-be-enabled-when-auto-provi","errorCode":null,"errorMessage":"allowAllGroups can only be enabled when Auto-provisioning is enabled.","messagePattern":"allowAllGroups can only be enabled when Auto-provisioning is enabled\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"error","filePath":"server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java","lineNumber":254,"sourceCode":"    }\n\n  }\n\n  private void throwIfConfigurationAlreadyExists() {\n    Optional.ofNullable(dbClient.propertiesDao().selectGlobalProperty(GITLAB_AUTH_ENABLED)).ifPresent(property -> {\n      throw BadRequestException.create(\"GitLab configuration already exists. Only one Gitlab configuration is supported.\");\n    });\n  }\n\n  private static void throwIfInvalidAllowedGroupConfigurationAndAutoProvisioning(ProvisioningType provisioningType, Set<String> allowedGroups, boolean allowAllGroups) {\n    if (provisioningType == AUTO_PROVISIONING && allowedGroups.isEmpty() && !allowAllGroups) {\n      throw new IllegalArgumentException(\"allowedGroups cannot be empty when Auto-provisioning is enabled and allowAllGroups is set to false.\");\n    }\n  }\n\n  private static void throwIfAllowAllGroupsAndJit(ProvisioningType provisioningType, boolean allowAllGroups) {\n    if (allowAllGroups && provisioningType != AUTO_PROVISIONING) {\n      throw new IllegalArgumentException(\"allowAllGroups can only be enabled when Auto-provisioning is enabled.\");\n    }\n  }\n\n  private static void throwIfAllowAllGroupsAndGitlabCloud(String url, boolean allowAllGroups) {\n    if (allowAllGroups && isGitlabCloudUrl(url)) {\n      throw new IllegalArgumentException(\n        \"allowAllGroups cannot be enabled when the GitLab URL is gitlab.com (GitLab SaaS). \"\n          + \"Use a self-managed GitLab instance, or restrict access via allowedGroups.\");\n    }\n  }\n\n  private static boolean shouldEnableAutoProvisioning(ProvisioningType provisioningType) {\n    return AUTO_PROVISIONING.equals(provisioningType);\n  }\n\n  private void setProperty(DbSession dbSession, String propertyName, @Nullable String value) {\n    dbClient.propertiesDao().saveProperty(dbSession, new PropertyDto().setKey(propertyName).setValue(value));\n  }","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-common/src/main/java/org/sonar/server/common/gitlab/config/GitlabConfigurationService.java#L236-L272","documentation":"allowAllGroups=true means every GitLab group feeds identity provisioning, which only makes sense when provisioningType is AUTO_PROVISIONING. GitlabConfigurationService.throwIfAllowAllGroupsAndJit rejects any configuration that enables allowAllGroups with a provisioning type other than AUTO_PROVISIONING (e.g. JIT or NONE).","triggerScenarios":"createConfiguration/updateConfiguration called with allowAllGroups=true and provisioningType set to something other than AUTO_PROVISIONING (JIT_PROVISIONING or NONE).","commonSituations":"Admins toggle 'allow all groups' while their provisioning mode is just-in-time; import scripts copy the allowAllGroups flag between configs with different provisioning types.","solutions":["Set provisioningType=AUTO_PROVISIONING in the same request that enables allowAllGroups.","Set allowAllGroups=false if you intend to keep JIT or non-auto provisioning."],"exampleFix":"// before\nPUT /api/gitlab/configure?provisioningType=JIT&allowAllGroups=true\n\n// after\nPUT /api/gitlab/configure?provisioningType=AUTO_PROVISIONING&allowAllGroups=true","handlingStrategy":"validation","validationCode":"// client-side check\nif (allowAllGroups && provisioningType != ProvisioningType.AUTO_PROVISIONING) {\n  throw new IllegalArgumentException(\"allowAllGroups requires AUTO_PROVISIONING\");\n}","typeGuard":null,"tryCatchPattern":"try { service.updateConfiguration(params); } catch (IllegalArgumentException e) { log.error(\"Config conflict: {}\", e.getMessage()); }","preventionTips":["Treat allowAllGroups as dependent on provisioningType in forms and scripts.","Reset allowAllGroups to false when changing provisioning type away from AUTO_PROVISIONING."],"tags":["gitlab","configuration","validation","auto-provisioning"],"backgroundTag":"conflicting-config-options","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}