SonarSource/sonarqube · error · IllegalStateException

It is not possible to synchronize SonarQube using GitHub, as

Error message

It is not possible to synchronize SonarQube using GitHub, as it is already managed by .

What it means

When validating a GitHub provisioning configuration, checkInstanceNotManagedByAnotherProvider consults ManagedInstanceService: if the instance is already externally managed (identity/provisioning delegated to another provider, e.g. Azure AD, GitLab, SAML-based managed sync), enabling GitHub synchronization is refused with this IllegalStateException. The provider name is interpolated into the message (hence the trailing dot placement).

Source

Thrown at server/sonar-webserver-common/src/main/java/org/sonar/server/common/github/config/GithubConfigurationService.java:360

      .orElse(Set.of());
  }

  private void triggerRun(GithubConfiguration githubConfiguration) {
    throwIfConfigIncompleteOrInstanceAlreadyManaged(githubConfiguration);
    managedInstanceService.queueSynchronisationTask(userSession.getUuid());
  }

  private void throwIfConfigIncompleteOrInstanceAlreadyManaged(GithubConfiguration configuration) {
    checkInstanceNotManagedByAnotherProvider();
    checkState(AUTO_PROVISIONING.equals(configuration.provisioningType()), "Auto provisioning must be activated");
    checkState(configuration.enabled(), getErrorMessage("GitHub authentication must be turned on"));
  }

  private void checkInstanceNotManagedByAnotherProvider() {
    if (managedInstanceService.isInstanceExternallyManaged()) {
      Optional.of(managedInstanceService.getProviderName()).filter(providerName -> !GitHubIdentityProvider.KEY.equals(providerName))
        .ifPresent(providerName -> {
          throw new IllegalStateException("It is not possible to synchronize SonarQube using GitHub, as it is already managed by " + providerName + ".");
        });
    }
  }

  private static String getErrorMessage(String prefix) {
    return format("%s to enable GitHub provisioning.", prefix);
  }

  public Optional<String> validate(GithubConfiguration configuration) {
    if (!configuration.enabled()) {
      return Optional.empty();
    }
    try {
      githubGlobalSettingsValidator.validate(configuration.applicationId(), configuration.clientId(), configuration.clientSecret(), configuration.privateKey(),
        configuration.apiUrl());
    } catch (Exception e) {
      return Optional.of(e.getMessage());
    }

View on GitHub (pinned to 184c821202)

Solutions

Disable/detach the current external management provider (Administration > the existing provisioning integration) before enabling GitHub provisioning
Or keep GitHub as the manager: if the provider shown is GitHub itself, this check is skipped, so re-verify which provider is active
Check managed instance status via admin APIs/UI to confirm the active provider
Plan one provider for provisioning — remove the conflicting integration first, then save the GitHub config

Example fix

// before
enable github provisioning while gitlab autosync active
// after
disable GitLab provisioning (delete GitLab configuration / turn off autosync), then createConfiguration(githubConfig)

Defensive patterns

Strategy: validation

Validate before calling

// before enabling GitHub provisioning
if (managedInstanceService.isInstanceExternallyManaged()
    && !"github".equals(managedInstanceService.getProviderName())) {
  throw new IllegalStateException("disable current provider: " + managedInstanceService.getProviderName());
}

Try / catch

try {
  service.createConfiguration(cfg);
} catch (IllegalStateException e) {
  if (e.getMessage().contains("already managed by")) {
    // disable the other provider, then retry once
    disableCurrentManagedInstanceProvider();
    service.createConfiguration(cfg);
  } else throw e;
}

Prevention

Keep exactly one provisioning/identity provider active at a time
Check the managed-instance status in Administration before enabling a new one
Script provider migrations as disable-old then enable-new, never both

When it happens

Trigger: Saving/updating GitHub configuration (createConfiguration with incomplete/managed checks via throwIfConfigIncompleteOrInstanceAlreadyManaged) while isInstanceExternallyManaged() is true and the managing provider's key is not 'github'.

Common situations: Instance already provisioned by GitLab or Azure DevOps autosync; admin migrates identity providers without disabling the previous managed-instance integration; SSO/SCIM provider configured org-wide.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/c436079e22cd09e3. Report an issue: GitHub.