SonarSource/sonarqube · error · AuthenticationException

Failed to authenticate with login '%s'

Error message

Failed to authenticate with login '%s'

What it means

UserRegistrarImpl.validateAlmSpecificData enforces identity-provider-specific rules during ALM (GitHub/GitLab/Bitbucket) authentication. For GitLab, all users must carry an external ID, so authenticating with the other two methods against a GitLab identity provider (or any GitLab provider match without it) immediately fails authentication with 'Failed to authenticate with login <login>'.

Source

Thrown at server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/UserRegistrarImpl.java:128

      .filter(user -> validateAlmSpecificData(user, provider.getKey(), userIdentity, source));
  }

  private Optional<UserDto> retrieveUserByLogin(DbSession dbSession, UserIdentity userIdentity, IdentityProvider provider) {
    return Optional.ofNullable(dbClient.userDao().selectByLogin(dbSession, userIdentity.getProviderLogin()))
      .filter(user -> shouldPerformLdapIdentityProviderMigration(user, provider));
  }

  private static boolean shouldPerformLdapIdentityProviderMigration(UserDto user, IdentityProvider identityProvider) {
    boolean isLdapIdentityProvider = identityProvider.getKey().startsWith(LDAP_PROVIDER_PREFIX);
    boolean hasSonarQubeExternalIdentityProvider = SONARQUBE.getKey().equals(user.getExternalIdentityProvider());

    return isLdapIdentityProvider && hasSonarQubeExternalIdentityProvider && !user.isLocal();
  }

  private static boolean validateAlmSpecificData(UserDto user, String key, UserIdentity userIdentity, Source source) {
    // All gitlab users have an external ID, so the other two authentication methods should never be used
    if (GITLAB_PROVIDER.equals(key)) {
      throw failAuthenticationException(userIdentity, source);
    }

    if (GITHUB_PROVIDER.equals(key)) {
      validateEmailToAvoidLoginRecycling(userIdentity, user, source);
      validateExternalIdToAvoidLoginRecycling(userIdentity, user, source);
    }

    if (BITBUCKET_PROVIDER.equals(key)) {
      validateExternalIdToAvoidLoginRecycling(userIdentity, user, source);
    }

    return true;
  }

  private static void validateEmailToAvoidLoginRecycling(UserIdentity userIdentity, UserDto user, Source source) {
    String dbEmail = user.getEmail();

    if (dbEmail == null) {

View on GitHub (pinned to 184c821202)

Solutions

1. Verify the DevOps Platform configuration: the identity provider key must match the actual provider (gitlab vs github vs bitbucket).
2. Check SonarQube server logs for the preceding WARN details identifying which validation failed.
3. Ensure the GitLab user account is active and exposes the expected external identity attributes.
4. Re-authenticate; if config is correct and the error persists, contact the administrator to review the alm settings.

Example fix

// before (sonar.properties)
sonar.auth.github.url=https://gitlab.example.com # wrong provider config
// after
sonar.auth.gitlab.url=https://gitlab.example.com

// admin check before login attempt
// DevOps Platform config provider key must match the actual ALM
assert almSetting.getProviderId().equals("gitlab") : "provider key must match ALM type";

try {
  UserDto user = userRegistrar.register(userIdentity, source);
} catch (AuthenticationException e) {
  if (e.getMessage().startsWith("Failed to authenticate with login")) {
    showGenericLoginError(); // do not leak internal details to end user
  }
}

When it happens

Trigger: A user logs in via GitLab identity provider and validateAlmSpecificData is reached with key GITLAB_PROVIDER — i.e. GitLab authentication whose user data fails the ALM-specific validation, aborting user registration/login.

Common situations: Misconfigured identity provider mapping (GitLab instance registered but user matched through a different flow); GitLab user record lacking the expected external identity data; changes in SonarQube's strict ALM validation rules after upgrade.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Identity provider %s does not exist or is not enabled
• Your GitLab token was revoked
• Your GitLab token is expired
• Your GitLab token has insufficient scope
• Invalid personal access token

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/3008f1507ec3a181. Report an issue: GitHub.