# GitLab auth integration

**URL:** <https://community.sonarsource.com/t/gitlab-auth-integration/101473>\
**Category:** SonarQube Server / Community Build\
**Tags:** authentication, gitlab\
**Created:** [September 26, 2023, 2:34pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473 "2023-09-26T14:34:39Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![ericlehmann](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@ericlehmann](https://community.sonarsource.com/u/ericlehmann)\
**Post date:** [September 26, 2023, 2:34pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/1 "2023-09-26T14:34:39Z")

</div>

I set up a new licensed SonarQube instance installed via helm. The installed version is 10.0.0.68432.  
I went to the [GitLab Authentication support page](https://docs.sonarsource.com/sonarqube/latest/instance-administration/authentication/gitlab/), followed the configuration steps. When a user tries to long in, they are greeting with a a message “You’re not authorized to access this page. Please contact the administrator.” The application is configured in GitLab, with the API scope, as described in the documentation. The logs from the SonarQube pod show the following after a sign in:

```auto
2023.09.26 14:17:41 WARN web[AYrR2VHhLMYbuQQuAAAv][o.s.s.a.AuthenticationError] Fail to callback authentication with 'gitlab'
com.github.scribejava.core.model.OAuth2AccessTokenErrorResponse: {"error":"invalid_client","error_description":"Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method."}
        at com.github.scribejava.core.extractors.OAuth2AccessTokenJsonExtractor.generateError(OAuth2AccessTokenJsonExtractor.java:77)
        at com.github.scribejava.core.extractors.OAuth2AccessTokenJsonExtractor.extract(OAuth2AccessTokenJsonExtractor.java:37)
        at com.github.scribejava.core.extractors.OAuth2AccessTokenJsonExtractor.extract(OAuth2AccessTokenJsonExtractor.java:17)
        at com.github.scribejava.core.oauth.OAuth20Service.sendAccessTokenRequestSync(OAuth20Service.java:157)
        at com.github.scribejava.core.oauth.OAuth20Service.getAccessToken(OAuth20Service.java:237)
        at com.github.scribejava.core.oauth.OAuth20Service.getAccessToken(OAuth20Service.java:232)
        at org.sonar.auth.gitlab.GitLabIdentityProvider.onCallback(GitLabIdentityProvider.java:115)
        at org.sonar.auth.gitlab.GitLabIdentityProvider.callback(GitLabIdentityProvider.java:102)
        at org.sonar.server.authentication.OAuth2CallbackFilter.handleOAuth2Provider(OAuth2CallbackFilter.java:92)
        at org.sonar.server.authentication.OAuth2CallbackFilter.handleProvider(OAuth2CallbackFilter.java:75)
        at org.sonar.server.authentication.OAuth2CallbackFilter.doFilter(OAuth2CallbackFilter.java:68)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:153)
        at org.sonar.server.authentication.DefaultAdminCredentialsVerifierFilter.doFilter(DefaultAdminCredentialsVerifierFilter.java:88)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:153)
        at org.sonar.server.platform.web.MasterServletFilter.doFilter(MasterServletFilter.java:116)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:81)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:68)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.sonar.server.platform.web.CspFilter.doFilter(CspFilter.java:63)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.sonar.server.platform.web.CacheControlFilter.doFilter(CacheControlFilter.java:76)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.sonar.server.platform.web.SecurityServletFilter.doHttpFilter(SecurityServletFilter.java:60)
        at org.sonar.server.platform.web.SecurityServletFilter.doFilter(SecurityServletFilter.java:47)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.sonar.server.platform.web.RedirectFilter.doFilter(RedirectFilter.java:57)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.sonar.server.platform.web.RequestIdFilter.doFilter(RequestIdFilter.java:66)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.sonar.server.platform.web.RootFilter.doFilter(RootFilter.java:64)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)
        at jdk.internal.reflect.GeneratedMethodAccessor45.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
        at java.base/java.lang.reflect.Method.invoke(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.lambda$execute$0(SecurityUtil.java:280)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at java.base/javax.security.auth.Subject.doAsPrivileged(Unknown Source)
        at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:311)
        at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:187)
        at org.apache.catalina.core.ApplicationFilterChain.lambda$doFilter$0(ApplicationFilterChain.java:145)
        at java.base/java.security.AccessController.doPrivileged(Unknown Source)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:177)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
        at ch.qos.logback.access.tomcat.LogbackValve.invoke(LogbackValve.java:262)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
        at org.sonar.server.app.SecureErrorReportValve.invoke(SecureErrorReportValve.java:37)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:360)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:399)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:891)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1784)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.base/java.lang.Thread.run(Unknown Source)

```

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [September 27, 2023, 8:05am UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/3 "2023-09-27T08:05:13Z")

</div>

Hey there.

- Are you using [Gitlab.com](http://Gitlab.com) or self-hosted Gitlab? We received a report some time ago that ultimately had do with some DNS stuff.

> [@Gitlab auth failing](https://community.sonarsource.com/t/gitlab-auth-failing/90449/7):
>
> @Colin Hi Colin. Yeah, I managed to get it working in the end. For some reason using sonarqube.mydomain.com worked nut sonar.mydomain.com didn’t. The DNS and config settings were definitely correct in both cases so not sure why the sonar subdomain was causing problems. All good now though.

- Have you configured “Allow users to sign up” under your GitLab Auth settings (SonarQube-side) to `true`?

> [@Not authorized to access sonarqube using gitlab credential](https://community.sonarsource.com/t/not-authorized-to-access-sonarqube-using-gitlab-credential/37383/2):
>
> Hi, That’s about this setting, which you’ll find with the ALM integration settings: [Selection\_999(376)] Your GitLab account isn’t already recognized by SonarQube, and you’re not being allowed to “sign up”. &nbsp; HTH, Ann

---

<div class="post-metadata">

**Author:** ![ericlehmann](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@ericlehmann](https://community.sonarsource.com/u/ericlehmann)\
**Post date:** [September 27, 2023, 1:26pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/4 "2023-09-27T13:26:31Z")

</div>

Thanks for your reply. This is a self-hosted GitLab instance. Allow users to sign up is checked and my desired behavior, but even if I create a matching user in SonarQube for the gitlab user, I’m getting this unauthorized message.

![Screenshot 2023-09-27 092455](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/d/c/dcf83ecb13ee972b0d41bd3e7142bd2949560aee.png)

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [September 27, 2023, 3:08pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/5 "2023-09-27T15:08:05Z")

</div>

> [@ericlehmann](#):
>
> even if I create a matching user in SonarQube for the gitlab user,

Don’t do that! That user is being created as a local user, and you would have to [update the identity provider](https://community.sonarsource.com/t/migrating-sonarqube-users-between-identity-providers-with-a-focus-on-ldap-saml/48653/2) to move that user to Gitlab.

- Does the URL that you’re using for your **Server Base URL** in your SonarQube administration match the URL that you’re providing for the application on Gitlab?
- Is your SonarQube server accessible over multiple URLs (multiple DNS entries), or just the one that is defined as the Redirect URL in gitlab?

---

<div class="post-metadata">

**Author:** ![ericlehmann](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@ericlehmann](https://community.sonarsource.com/u/ericlehmann)\
**Post date:** [September 27, 2023, 3:25pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/6 "2023-09-27T15:25:37Z")

</div>

It didn’t work before I added the user or with users I didn’t ever add. I thought it could hurt to try before tearing down the cluster and trying to redeploy the applications.

Key: sonar.core.serverBaseURL=[https://sonarqube.mycluster.dev.mycompany.us](https://sonarqube.mycluster.dev.mycompany.us)

Regarding multiple URL’s, I have [https://sonarqube.mycluster.dev.mycompany.us](https://sonarqube.mycluster.dev.mycompany.us) which is the only method I have to access sonarqube. I suppose it’s internally accessible to the cluster via the ..svc.cluster.local, but there should be no other URL’s for sonarqube in any practical sense.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [September 27, 2023, 3:29pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/7 "2023-09-27T15:29:07Z")

</div>

Thanks.

> [@ericlehmann](#):
>
> sonar.core.serverBaseURL=[https://sonarqube.mycluster.dev.mycompany.us](https://sonarqube.mycluster.dev.mycompany.us)

Is this configured in the UI, or in some properties file (where it’s not meant to be)?

I would also start to get curious about whether or not something in the middle could be stripping away information from the request as it goes from SonarQube → Gitlab → SonarQube. Are you using any specific reverse proxies / load balancers in between?

---

<div class="post-metadata">

**Author:** ![ericlehmann](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@ericlehmann](https://community.sonarsource.com/u/ericlehmann)\
**Post date:** [September 27, 2023, 3:39pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/8 "2023-09-27T15:39:14Z")

</div>

HAproxy forwarding to istio for the https request. Base URl is configured just in the UI.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [September 27, 2023, 3:40pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/9 "2023-09-27T15:40:21Z")

</div>

In the spirit of eliminating causes, could you try to cut out HAProxy and serve your SonarQube server over HTTP for a round of testing?

---

<div class="post-metadata">

**Author:** ![ericlehmann](https://avatars.discourse-cdn.com/v4/letter/e/bc79bd/32.png) [@ericlehmann](https://community.sonarsource.com/u/ericlehmann)\
**Post date:** [September 28, 2023, 9:37am UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/10 "2023-09-28T09:37:51Z")

</div>

Thanks for your help Colin. That’d be kind of a hard lift, so I’d like to avoid it. I was able to resolve my issues by swapping out your helm chart for IronBank’s. This gives me an older version of your application, but I think it’ll meet my needs since the GitLab integration works.

Just because it’s easy, I’m going to blame FIPS or SELinux for the issue and assume the IronBank images had some modification that enables it to work.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [September 29, 2023, 2:04pm UTC](https://community.sonarsource.com/t/gitlab-auth-integration/101473/11 "2023-09-29T14:04:01Z")

</div>

Hm. That just begs more questions! Which older version is working?