SonarSource/sonarqube · error · IllegalStateException

Cannot extract Azure Access Token from response

Error message

Cannot extract Azure Access Token from response

What it means

Thrown when the Azure Marketplace token-exchange endpoint responded successfully but its response body contained no parseable access token. DefaultAzureBillingHandler.getAzureUserToken treats this as an unexpected upstream response and raises IllegalStateException, which surfaces as a 500.

Solutions

1. Retry the billing operation; Azure may return a well-formed response on a second attempt
2. Inspect the actual response body returned by Azure for the token endpoint
3. Verify Azure Marketplace billing API configuration (resource ID, endpoint) is current for your SonarQube version
4. Upgrade SonarQube to get updated Azure response parsing
5. Check network proxies are not altering the response

Example fix

// before
if (accessToken.isPresent()) {
  return accessToken.get();
} else {
  throw new IllegalStateException("Cannot extract Azure Access Token from response");
}
// after
if (accessToken.isPresent()) {
  return accessToken.get();
} else {
  logError("Token exchange response body: " + response.body());
  throw new IllegalStateException("Cannot extract Azure Access Token from response. Raw body: " + response.body());
}

// No client-side pre-check can detect a malformed Azure response; verify connectivity
// and that the instance is properly linked to an active Azure Marketplace subscription
// before triggering billing:
// GET /api/v2/azure/billing (or subscription status) must succeed first.

null

try {
  await billAzureAccount(subscriptionId);
} catch (err) {
  if (err.status >= 500 && /Cannot extract Azure Access Token/.test(err.message || '')) {
    // retry with backoff; if persistent, report to SonarSource with the response body
  } else { throw err; }
}

When it happens

Trigger: billAzureAccount flow: the Azure billing API returns HTTP 2xx but azureBillingResponseHandler.extractAccessTokenFromResponse returns empty (changed response schema, empty body, missing token field).

Common situations: Azure changing the Marketplace billing API response format, a proxy returning an unexpected 200 HTML page, intermittent Azure-side issues producing empty token payloads.

Related errors

• Cannot obtain Azure Access Token. Details:
• Fail to execute request
• For security reasons, OAuth authentication should use…
• Interrupted while getting a token:
• No client ID for setting with key

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/9d84296e5eee61a5. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-webserver-webapi-v2/src/main/java/org/sonar/server/v2/api/azurebilling/service/DefaultAzureBillingHandler.java:83

    return handleAzureBillingRequest(request);
  }

  private String getAzureUserToken() {

    String clientId = azureEnvironment.getAzureClientId()
      .orElseThrow(() -> new IllegalStateException("Azure Client ID is not configured"));

    Request tokenRequest = azureBillingRequestBuilder.getAzureUserTokenRequest(clientId);

    try (Response response = client.newCall(tokenRequest).execute()) {
      if (response.isSuccessful()) {
        Optional<String> accessToken = azureBillingResponseHandler.extractAccessTokenFromResponse(response);

        if (accessToken.isPresent()) {
          return accessToken.get();
        } else {
          logError("Cannot extract Azure Access Token from response.");
          throw new IllegalStateException("Cannot extract Azure Access Token from response");
        }
      } else {
        logError(response.message());
        throw new IllegalStateException("Cannot obtain Azure Access Token. Details: " + response.message());
      }
    } catch (IOException e) {
      logError(e.getMessage());
      throw new IllegalStateException("Cannot obtain Azure Access Token. Details: " + e.getMessage());
    }
  }

  private String getResourceId() {
    return azureEnvironment.getResourceId()
      .orElseThrow(() -> new IllegalStateException("Azure Resource ID is not configured"));
  }

  private String getPlanId() {
    return azureEnvironment.getPlanId()

View on GitHub (pinned to 184c821202)