SonarSource/sonarqube · warning

Skipping GitHub authentication setup: {}

Error message

Skipping GitHub authentication setup: {}

What it means

This warning is logged by GithubManifestCallbackFilter.setupAuthentication when, during the GitHub App manifest configuration flow, creating the GitHub authentication configuration fails with a BadRequestException — which in practice means a GitHub authentication configuration already exists. The filter logs and continues the flow, leaving the existing configuration untouched.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/almsettings/ws/GithubManifestCallbackFilter.java:209

      true,
      credentials.clientId(),
      credentials.clientSecret(),
      credentials.getAppId(),
      credentials.pem(),
      false,
      "https://api.github.com/",
      "https://github.com/",
      allowedOrganizations,
      ProvisioningType.JIT,
      true,
      true,
      false);
    try {
      githubConfigurationService.createConfiguration(dbSession, configuration);
      return true;
    } catch (BadRequestException e) {
      // A GitHub authentication configuration already exists; leave it untouched but continue the flow.
      LOG.warn("Skipping GitHub authentication setup: {}", e.getMessage());
      return false;
    }
  }

  private String success(PendingManifest pending) {
    String url = manifestGenerator.baseUrl() + settingsPathFor(pending) + "&almManifestResult=success";
    if (pending.settingKey() != null) {
      url += "&almKey=" + encode(pending.settingKey());
    }
    return url;
  }

  // Used before the pending state is resolved (blank params, non-admin, invalid/expired state): the
  // originating page is unknown, so fall back to the DevOps integration settings page.
  private String error(String message) {
    return errorOn(SETTINGS_PATH, message);
  }

View on GitHub (pinned to 184c821202)

Solutions

1. This is benign if the existing GitHub authentication configuration is correct — verify it under Administration > Security > GitHub and keep it
2. If a fresh authentication setup is desired, delete the existing GitHub authentication configuration first, then re-run the manifest flow
3. Use api/users/identity_providers or the settings UI to inspect the existing identity provider before changing anything
4. Avoid re-submitting the manifest callback; the manifest token is single-use and a rerun only re-triggers this path

Example fix

null

// Before running the manifest flow, check whether GitHub authentication is already configured
// e.g. Administration > Security > GitHub, or identity provider listing API — skip auto-setup if present

// The filter already handles it: treat this warning as expected and non-blocking
// if (existingGithubAuthIsValid) { proceed with manifest flow; ignore this warning }

When it happens

Trigger: Completing the GitHub App manifest auto-configuration flow (POST on the callback URL) while a GitHub authentication integration already exists in SonarQube; the service refuses to create a second one.

Common situations: Administrator retries the manifest setup after it partially completed the first time; a GitHub App (alm settings) and a GitHub authentication setting both exist; two admins run the auto-setup concurrently.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Failed to construct GitHub repository URL for ALM setting '{
• Failed to fetch GitLab repository URL for ALM setting '{}' a
• Failed to fetch Azure repository URL for ALM setting '{}', p
• Failed to validate configuration, check URL and Private Key
• Authentication failed, verify the Client Id, Client Secret a

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/52286666c4ee8c94. Report an issue: GitHub.