SonarQube Fails with SAML (Saml2AuthenticationException) error after upgrading to LTS 2025.0.1

SonarQube Server / Community Build
1

Must-share information (formatted with Markdown):

  • which versions are you using: SonarQube Developer LTS 2025.0.1
  • how is SonarQube deployed: Helm and deployed on AKS
  • what are you trying to achieve: Trying to Upgrade SonarQube from LTS version 9.9 to LTS 2025.0.1
  • what have you tried so far to achieve this

We followed the documentation to deploy the Sonarqube latest verision helm-chart-sonarqube/charts/sonarqube at master · SonarSource/helm-chart-sonarqube, However after deploying we are facing the SAML issues

2025.02.13 15:29:11 WARN  web[79561f11-3220-4e9b-b9d2-d350112dc44b][o.s.s.a.AuthenticationError] Fail to callback authentication with 'saml'
org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException: Invalid destination [****/oauth2/callback/saml] for SAML response [id2752434629437421054675247]
        at org.springframework.security.saml2.provider.service.authentication.BaseOpenSamlAuthenticationProvider.createAuthenticationException(BaseOpenSamlAuthenticationProvider.java:488)
        at org.springframework.security.saml2.provider.service.authentication.BaseOpenSamlAuthenticationProvider.process(BaseOpenSamlAuthenticationProvider.java:358)
        at org.springframework.security.saml2.provider.service.authentication.BaseOpenSamlAuthenticationProvider.authenticate(BaseOpenSamlAuthenticationProvider.java:280)
        at org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider.authenticate(OpenSaml4AuthenticationProvider.java:352)
        at org.sonar.auth.saml.SamlResponseAuthenticator.authenticate(SamlResponseAuthenticator.java:46)
        at org.sonar.auth.saml.SamlAuthenticator.onCallback(SamlAuthenticator.java:69)
        at org.sonar.auth.saml.SamlIdentityProvider.callback(SamlIdentityProvider.java:81)
        at org.sonar.server.authentication.OAuth2CallbackFilter.handleOAuth2Provider(OAuth2CallbackFilter.java:87)
        at org.sonar.server.authentication.OAuth2CallbackFilter.handleProvider(OAuth2CallbackFilter.java:70)
        at org.sonar.server.authentication.OAuth2CallbackFilter.doFilter(OAuth2CallbackFilter.java:63)
        at org.sonar.server.platform.web.MasterServletFilter$JavaxFilterAdapter.doFilter(MasterServletFilter.java:194)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:165)
        at org.sonar.server.platform.web.MasterServletFilter$HttpFilterChainAdapter.doFilter(MasterServletFilter.java:208)
        at org.sonar.server.authentication.SamlValidationRedirectionFilter.doFilter(SamlValidationRedirectionFilter.java:94)
        at org.sonar.server.platform.web.MasterServletFilter$JavaxFilterAdapter.doFilter(MasterServletFilter.java:194)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:165)
        at org.sonar.server.platform.web.MasterServletFilter$HttpFilterChainAdapter.doFilter(MasterServletFilter.java:208)
        at org.sonar.server.authentication.DefaultAdminCredentialsVerifierFilter.doFilter(DefaultAdminCredentialsVerifierFilter.java:83)
        at org.sonar.server.platform.web.MasterServletFilter$JavaxFilterAdapter.doFilter(MasterServletFilter.java:194)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:165)
        at org.sonar.server.platform.web.MasterServletFilter.doFilter(MasterServletFilter.java:126)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:83)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:70)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.CspFilter.doFilter(CspFilter.java:67)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.CacheControlFilter.doFilter(CacheControlFilter.java:76)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.SecurityServletFilter.doHttpFilter(SecurityServletFilter.java:60)
        at org.sonar.server.platform.web.SecurityServletFilter.doFilter(SecurityServletFilter.java:47)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.RedirectFilter.doFilter(RedirectFilter.java:56)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.EndpointPathFilter.doFilter(EndpointPathFilter.java:47)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.RequestIdFilter.doFilter(RequestIdFilter.java:66)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.RootFilter.doFilter(RootFilter.java:65)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:115)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115)
        at ch.qos.logback.access.tomcat.LogbackValve.invoke(LogbackValve.java:268)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:397)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:905)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1741)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
        at java.base/java.lang.Thread.run(Thread.java:840)

We also reviewed the below Post but where do we need to place onar.core.serverBaseURL: value and what is the serverUrl we need to use?

SonarQube upgrade to 2025.1.0 impacting SAML Okta authentication - SonarQube Server / Community Build - Sonar Community

Note: We disabled SonarQube admin user to explicitly use SAML Authentication and provide user access.

2

Hey there.

You can configure sonar.core.serverBaseURL in the global ** Administration > General > Server Base URL**

image
image1990×490 52.7 KB

3

Hello,

In the serverBaseURL you put the URL of your deployed instance of SonarQube e.g.: https://sonar.mycompany.com/.

This will help redirect your callback to this endpoint configured on the SAML application side instead of localhost.

The configuration is where Colin mentioned in the screenshot.

Regards,
Oumayma.

4

Hi Colin,
Thanks for your reply, Once we deploy the latest version we cant login into our SonarQube instance as it says SAML Authentication Exception so i can not update this configuration from UI.

5

You can either: