SonarQube Fails with SAML (Saml2AuthenticationException) error after upgrading to LTS 2025.0.1

Nisharunnisa · February 13, 2025, 8:33am

Must-share information (formatted with Markdown):

which versions are you using: SonarQube Developer LTS 2025.0.1
how is SonarQube deployed: Helm and deployed on AKS
what are you trying to achieve: Trying to Upgrade SonarQube from LTS version 9.9 to LTS 2025.0.1
what have you tried so far to achieve this

We followed the documentation to deploy the Sonarqube latest verision helm-chart-sonarqube/charts/sonarqube at master · SonarSource/helm-chart-sonarqube, However after deploying we are facing the SAML issues

2025.02.13 15:29:11 WARN  web[79561f11-3220-4e9b-b9d2-d350112dc44b][o.s.s.a.AuthenticationError] Fail to callback authentication with 'saml'
org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException: Invalid destination [****/oauth2/callback/saml] for SAML response [id2752434629437421054675247]
        at org.springframework.security.saml2.provider.service.authentication.BaseOpenSamlAuthenticationProvider.createAuthenticationException(BaseOpenSamlAuthenticationProvider.java:488)
        at org.springframework.security.saml2.provider.service.authentication.BaseOpenSamlAuthenticationProvider.process(BaseOpenSamlAuthenticationProvider.java:358)
        at org.springframework.security.saml2.provider.service.authentication.BaseOpenSamlAuthenticationProvider.authenticate(BaseOpenSamlAuthenticationProvider.java:280)
        at org.springframework.security.saml2.provider.service.authentication.OpenSaml4AuthenticationProvider.authenticate(OpenSaml4AuthenticationProvider.java:352)
        at org.sonar.auth.saml.SamlResponseAuthenticator.authenticate(SamlResponseAuthenticator.java:46)
        at org.sonar.auth.saml.SamlAuthenticator.onCallback(SamlAuthenticator.java:69)
        at org.sonar.auth.saml.SamlIdentityProvider.callback(SamlIdentityProvider.java:81)
        at org.sonar.server.authentication.OAuth2CallbackFilter.handleOAuth2Provider(OAuth2CallbackFilter.java:87)
        at org.sonar.server.authentication.OAuth2CallbackFilter.handleProvider(OAuth2CallbackFilter.java:70)
        at org.sonar.server.authentication.OAuth2CallbackFilter.doFilter(OAuth2CallbackFilter.java:63)
        at org.sonar.server.platform.web.MasterServletFilter$JavaxFilterAdapter.doFilter(MasterServletFilter.java:194)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:165)
        at org.sonar.server.platform.web.MasterServletFilter$HttpFilterChainAdapter.doFilter(MasterServletFilter.java:208)
        at org.sonar.server.authentication.SamlValidationRedirectionFilter.doFilter(SamlValidationRedirectionFilter.java:94)
        at org.sonar.server.platform.web.MasterServletFilter$JavaxFilterAdapter.doFilter(MasterServletFilter.java:194)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:165)
        at org.sonar.server.platform.web.MasterServletFilter$HttpFilterChainAdapter.doFilter(MasterServletFilter.java:208)
        at org.sonar.server.authentication.DefaultAdminCredentialsVerifierFilter.doFilter(DefaultAdminCredentialsVerifierFilter.java:83)
        at org.sonar.server.platform.web.MasterServletFilter$JavaxFilterAdapter.doFilter(MasterServletFilter.java:194)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:165)
        at org.sonar.server.platform.web.MasterServletFilter.doFilter(MasterServletFilter.java:126)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:83)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:70)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.CspFilter.doFilter(CspFilter.java:67)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.CacheControlFilter.doFilter(CacheControlFilter.java:76)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.SecurityServletFilter.doHttpFilter(SecurityServletFilter.java:60)
        at org.sonar.server.platform.web.SecurityServletFilter.doFilter(SecurityServletFilter.java:47)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.RedirectFilter.doFilter(RedirectFilter.java:56)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.EndpointPathFilter.doFilter(EndpointPathFilter.java:47)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.RequestIdFilter.doFilter(RequestIdFilter.java:66)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.sonar.server.platform.web.RootFilter.doFilter(RootFilter.java:65)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:115)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:164)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:140)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:483)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115)
        at ch.qos.logback.access.tomcat.LogbackValve.invoke(LogbackValve.java:268)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:397)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:905)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1741)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1190)
        at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63)
        at java.base/java.lang.Thread.run(Thread.java:840)

We also reviewed the below Post but where do we need to place onar.core.serverBaseURL: value and what is the serverUrl we need to use?

SonarQube upgrade to 2025.1.0 impacting SAML Okta authentication - SonarQube Server / Community Build - Sonar Community

Note: We disabled SonarQube admin user to explicitly use SAML Authentication and provide user access.

Colin · February 13, 2025, 8:46am

Hey there.

You can configure sonar.core.serverBaseURL in the global ** Administration > General > Server Base URL**

oumayma · February 13, 2025, 8:55am

Hello,

In the serverBaseURL you put the URL of your deployed instance of SonarQube e.g.: https://sonar.mycompany.com/.

This will help redirect your callback to this endpoint configured on the SAML application side instead of localhost.

The configuration is where Colin mentioned in the screenshot.

Regards,
Oumayma.

Nisharunnisa · February 13, 2025, 9:09am

Hi Colin,
Thanks for your reply, Once we deploy the latest version we cant login into our SonarQube instance as it says SAML Authentication Exception so i can not update this configuration from UI.

Colin · February 13, 2025, 9:36am

You can either:

Rollback and set this prior to the upgrade
Restore administrator access to a local user.

system · February 20, 2025, 9:36am

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.