SonarSource/sonarqube · error · IllegalArgumentException

Missing Client Secret

Error message

Missing Client Secret

What it means

Thrown by GithubGlobalSettingsValidator.buildConfiguration when the 'Client ID' companion setting is present but the decrypted 'Client Secret' setting is blank. SonarQube requires both values to build a GithubAppConfiguration for validating GitHub ALM settings.

Source

Thrown at server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/GithubGlobalSettingsValidator.java:102

      almSettingDto.getClientSecret(), almSettingDto.getPrivateKey(), almSettingDto.getUrl());

    githubApplicationClient.checkApiEndpoint(configuration);
    return githubApplicationClient.findMissingAppPermissions(configuration, requiredPermissions);
  }

  private GithubAppConfiguration buildConfiguration(@Nullable String applicationId, @Nullable String clientId, String clientSecret, String privateKey,
    @Nullable String url) {
    long appId;
    try {
      appId = Long.parseLong(Optional.ofNullable(applicationId).orElseThrow(() -> new IllegalArgumentException("Missing appId")));
    } catch (NumberFormatException e) {
      throw new IllegalArgumentException("Invalid appId; " + e.getMessage());
    }
    if (isBlank(clientId)) {
      throw new IllegalArgumentException("Missing Client Id");
    }
    if (isBlank(getDecryptedSettingValue(clientSecret))) {
      throw new IllegalArgumentException("Missing Client Secret");
    }
    return new GithubAppConfiguration(appId, getDecryptedSettingValue(privateKey), url);
  }

  private String getDecryptedSettingValue(String setting) {
    if (StringUtils.isNotEmpty(setting) && encryption.isEncrypted(setting)) {
      return encryption.decrypt(setting);
    }
    return setting;
  }
}

View on GitHub (pinned to 184c821202)

Solutions

1. Set the 'Client Secret' field in the GitHub ALM integration settings to the app's client secret
2. Verify the secret was pasted fully without leading/trailing whitespace removal that blanked it
3. Check the encryption configuration so getDecryptedSettingValue returns the plaintext secret, not an empty string

Example fix

// before: clientSecret left empty in settings form
// after: settings.setClientSecret("<github-app-client-secret>");

if (clientId != null && !clientId.isBlank() && (clientSecret == null || clientSecret.isBlank())) {
  throw new IllegalStateException("GitHub Client Secret is required when Client Id is set");
}

try { validator.validate(settings); } catch (IllegalArgumentException e) { displayFieldError("clientSecret", e.getMessage()); }

When it happens

Trigger: Calling buildConfiguration via configuration() with a non-blank clientId but a blank or whitespace-only clientSecret setting (after decryption).

Common situations: Admin enters the GitHub App Client ID but leaves Client Secret empty in the ALM integration settings; secret fails to decrypt to a non-empty value; setting was cleared during migration.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• Missing URL
• Invalid URL, %s
• Invalid appId;
• Cannot mint a GitHub installation token: project '{}' is not
• Cannot mint a GitHub installation token: project '{}' has no

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/02609571908df8da. Report an issue: GitHub.