Managing JIT provisioning

Once you’ve set up GitLab authentication and provisioning with the Just-in-Time (JIT) provisioning mode, you can set or change JIT provisioning mode options.

You need the global Administer System permission in SonarQube Server to perform this setup.

Setting up the group synchronization

With the JIT provisioning mode, you can enable group synchronization. The group synchronization requires that you manually create the user groups in SonarQube Server: see below.

If you enable the group synchronization, you cannot manage group memberships manually and existing manually added group memberships of JIT-provisioned users are reset in SonarQube Server during synchronization.

1. Go to Administration > Configuration > General Settings > Authentication > GitLab.
2. On the far right of App ID, select Edit.
3. In the dialog, select or unselect the Synchronize user groups option.
4. Save.

Creating the user groups in SonarQube Server

To allow group synchronization, you must create in SonarQube Server a group for each GitLab group and subgroup you want to synchronize, see Managing groups.

You must name the SonarQube Server group according to the URL of the GitLab group or subgroup. Be aware that that name check is case-sensitive.

Examples:

• If the URL of the GitLab group is https://gitlab.com/my-gitlab-group, the name of the SonarQube Server group mus be my-gitlab-group.
• If the URL of the GitLab group is https://gitlab.com/my-gitlab-group/sub-group, the name of the SonarQube Server group must be my-gitlab-group/sub-group.

To set the group permissions at the system level, see Managing permissions.

Restricting provisioning to specific groups

You can restrict provisioning to specific groups. To do so, you specify the GitLab root groups (groups with no parent) to be allowed: only members of the specified groups and all their subgroups will be provisioned in SonarQube Server.

To restrict provisioning to specific groups:

1. Go to Administration > Configuration > General Settings > Authentication > GitLab.
2. In the Provisioning > Just-in-Time provisioning > Allowed groups, enter the root group slug as it appears in the GitLab URL. For instance, if the allowed group URL is https://gitlab.com/my-root-group, then enter my-root-group. A new text box is added underneath.
3. Enter another allowed group slug, etc.

Blocking/Authorizing the sign-up of new users

You can block the signup of new users with SonarQube. This may be useful if you want to manage user provisioning through an API.

To block or authorize the sign-up of new users with SonarQube Server:

1. Go to Administration > Configuration > General Settings > Authentication > GitLab.
2. In the Provisioning > Just-in-Time provisioning section, unselect or select Allow users to sign up.

Related pages

• Just-in-Time provisioning

• Automatic provisioning

• Setting up authentication

• Managing permissions