Okta SCIM started to fail with "error code: 1006"

[peterzeng-circle (Peter Zeng)]

Must-share information (formatted with Markdown):

• which versions are you using: SonarQube Server Enterprise v10.7 (96327)

• how is SonarQube deployed: Helm

• what are you trying to achieve:

We have set up Okta SCIM push group integration since January 2024. It has been working normally until Nov. 30th (estimated), when Okta fails to connect to both our staging and prod instance. The error message is below.

Error authenticating: Forbidden. Errors reported by remote server: Invalid JSON: Unrecognized token ‘error’: was expecting (JSON String, Number, Array, Object or token ‘null’, ‘true’ or 'false") at [Source: (String)“error code:1006”; line: 1, column: 6]

We did not deploy any change around the date. We upgraded SonarQube helm chart to 10.7 on Nov. 1st and the SCIM integration keeps working until Nov. 30th. The Okta SAML integration is not impacted on the other hand.

• what have you tried so far to achieve this

1. Generating a new SonarQube user token, still the same error

[Colin]

Hey there.

I am 99% certain that SonarQube itself won’t return a 1006 error, and you actually can confirm if the Okta request ever reaches SonarQube by checking your access.log file.

Most likely, something sitting in between SonarQube and Okta is returning the error. For example: CloudFlare returns a 1006 error indicating a banned IP address.

I would suggest you start there:

• Verify if the request ever actually reaches SonarQube
• Assuming it doesn’t determine what could be in between (web application firewall, proxy) and review configuration/configuration changes to those services that could have been made around the time it stopped working.