{"record":{"id":"3008f1507ec3a181","repo":"SonarSource/sonarqube","slug":"failed-to-authenticate-with-login-s","errorCode":null,"errorMessage":"Failed to authenticate with login '%s'","messagePattern":"Failed to authenticate with login '(.+?)'","errorType":"exception","errorClass":"AuthenticationException","httpStatus":401,"severity":"error","filePath":"server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/UserRegistrarImpl.java","lineNumber":128,"sourceCode":"      .filter(user -> validateAlmSpecificData(user, provider.getKey(), userIdentity, source));\n  }\n\n  private Optional<UserDto> retrieveUserByLogin(DbSession dbSession, UserIdentity userIdentity, IdentityProvider provider) {\n    return Optional.ofNullable(dbClient.userDao().selectByLogin(dbSession, userIdentity.getProviderLogin()))\n      .filter(user -> shouldPerformLdapIdentityProviderMigration(user, provider));\n  }\n\n  private static boolean shouldPerformLdapIdentityProviderMigration(UserDto user, IdentityProvider identityProvider) {\n    boolean isLdapIdentityProvider = identityProvider.getKey().startsWith(LDAP_PROVIDER_PREFIX);\n    boolean hasSonarQubeExternalIdentityProvider = SONARQUBE.getKey().equals(user.getExternalIdentityProvider());\n\n    return isLdapIdentityProvider && hasSonarQubeExternalIdentityProvider && !user.isLocal();\n  }\n\n  private static boolean validateAlmSpecificData(UserDto user, String key, UserIdentity userIdentity, Source source) {\n    // All gitlab users have an external ID, so the other two authentication methods should never be used\n    if (GITLAB_PROVIDER.equals(key)) {\n      throw failAuthenticationException(userIdentity, source);\n    }\n\n    if (GITHUB_PROVIDER.equals(key)) {\n      validateEmailToAvoidLoginRecycling(userIdentity, user, source);\n      validateExternalIdToAvoidLoginRecycling(userIdentity, user, source);\n    }\n\n    if (BITBUCKET_PROVIDER.equals(key)) {\n      validateExternalIdToAvoidLoginRecycling(userIdentity, user, source);\n    }\n\n    return true;\n  }\n\n  private static void validateEmailToAvoidLoginRecycling(UserIdentity userIdentity, UserDto user, Source source) {\n    String dbEmail = user.getEmail();\n\n    if (dbEmail == null) {","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/UserRegistrarImpl.java#L110-L146","documentation":"UserRegistrarImpl.validateAlmSpecificData enforces identity-provider-specific rules during ALM (GitHub/GitLab/Bitbucket) authentication. For GitLab, all users must carry an external ID, so authenticating with the other two methods against a GitLab identity provider (or any GitLab provider match without it) immediately fails authentication with 'Failed to authenticate with login <login>'.","triggerScenarios":"A user logs in via GitLab identity provider and validateAlmSpecificData is reached with key GITLAB_PROVIDER — i.e. GitLab authentication whose user data fails the ALM-specific validation, aborting user registration/login.","commonSituations":"Misconfigured identity provider mapping (GitLab instance registered but user matched through a different flow); GitLab user record lacking the expected external identity data; changes in SonarQube's strict ALM validation rules after upgrade.","solutions":["Verify the DevOps Platform configuration: the identity provider key must match the actual provider (gitlab vs github vs bitbucket).","Check SonarQube server logs for the preceding WARN details identifying which validation failed.","Ensure the GitLab user account is active and exposes the expected external identity attributes.","Re-authenticate; if config is correct and the error persists, contact the administrator to review the alm settings."],"exampleFix":"// before (sonar.properties)\nsonar.auth.github.url=https://gitlab.example.com # wrong provider config\n// after\nsonar.auth.gitlab.url=https://gitlab.example.com","handlingStrategy":"validation","validationCode":"// admin check before login attempt\n// DevOps Platform config provider key must match the actual ALM\nassert almSetting.getProviderId().equals(\"gitlab\") : \"provider key must match ALM type\";","typeGuard":null,"tryCatchPattern":"try {\n  UserDto user = userRegistrar.register(userIdentity, source);\n} catch (AuthenticationException e) {\n  if (e.getMessage().startsWith(\"Failed to authenticate with login\")) {\n    showGenericLoginError(); // do not leak internal details to end user\n  }\n}","preventionTips":["Configure GitLab instances only under the gitlab provider key","Ensure GitLab user profiles expose the expected external identity attributes","Review sonar.log WARN entries when SSO logins fail","Re-check ALM configuration after SonarQube upgrades"],"tags":["authentication","sonarqube","gitlab","alm","sso"],"backgroundTag":"authentication-required","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}