{"record":{"id":"02609571908df8da","repo":"SonarSource/sonarqube","slug":"missing-client-secret","errorCode":null,"errorMessage":"Missing Client Secret","messagePattern":"Missing Client Secret","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/GithubGlobalSettingsValidator.java","lineNumber":102,"sourceCode":"      almSettingDto.getClientSecret(), almSettingDto.getPrivateKey(), almSettingDto.getUrl());\n\n    githubApplicationClient.checkApiEndpoint(configuration);\n    return githubApplicationClient.findMissingAppPermissions(configuration, requiredPermissions);\n  }\n\n  private GithubAppConfiguration buildConfiguration(@Nullable String applicationId, @Nullable String clientId, String clientSecret, String privateKey,\n    @Nullable String url) {\n    long appId;\n    try {\n      appId = Long.parseLong(Optional.ofNullable(applicationId).orElseThrow(() -> new IllegalArgumentException(\"Missing appId\")));\n    } catch (NumberFormatException e) {\n      throw new IllegalArgumentException(\"Invalid appId; \" + e.getMessage());\n    }\n    if (isBlank(clientId)) {\n      throw new IllegalArgumentException(\"Missing Client Id\");\n    }\n    if (isBlank(getDecryptedSettingValue(clientSecret))) {\n      throw new IllegalArgumentException(\"Missing Client Secret\");\n    }\n    return new GithubAppConfiguration(appId, getDecryptedSettingValue(privateKey), url);\n  }\n\n  private String getDecryptedSettingValue(String setting) {\n    if (StringUtils.isNotEmpty(setting) && encryption.isEncrypted(setting)) {\n      return encryption.decrypt(setting);\n    }\n    return setting;\n  }\n}\n","sourceCodeStart":84,"sourceCodeEnd":114,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/GithubGlobalSettingsValidator.java#L84-L114","documentation":"Thrown by GithubGlobalSettingsValidator.buildConfiguration when the 'Client ID' companion setting is present but the decrypted 'Client Secret' setting is blank. SonarQube requires both values to build a GithubAppConfiguration for validating GitHub ALM settings.","triggerScenarios":"Calling buildConfiguration via configuration() with a non-blank clientId but a blank or whitespace-only clientSecret setting (after decryption).","commonSituations":"Admin enters the GitHub App Client ID but leaves Client Secret empty in the ALM integration settings; secret fails to decrypt to a non-empty value; setting was cleared during migration.","solutions":["Set the 'Client Secret' field in the GitHub ALM integration settings to the app's client secret","Verify the secret was pasted fully without leading/trailing whitespace removal that blanked it","Check the encryption configuration so getDecryptedSettingValue returns the plaintext secret, not an empty string"],"exampleFix":"// before: clientSecret left empty in settings form\n// after: settings.setClientSecret(\"<github-app-client-secret>\");","handlingStrategy":"validation","validationCode":"if (clientId != null && !clientId.isBlank() && (clientSecret == null || clientSecret.isBlank())) {\n  throw new IllegalStateException(\"GitHub Client Secret is required when Client Id is set\");\n}","typeGuard":null,"tryCatchPattern":"try { validator.validate(settings); } catch (IllegalArgumentException e) { displayFieldError(\"clientSecret\", e.getMessage()); }","preventionTips":["Make Client Secret a required form field whenever Client Id is filled","Verify encryption/decryption round-trips the secret to a non-empty value before saving settings","Re-test ALM settings after any SonarQube upgrade or encryption key change"],"tags":["github","configuration","validation","alm-integration"],"backgroundTag":"missing-required-config-field","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}