Sonarqube SAML Integration

[ashokkumarsarma.r]

Must-share information (formatted with Markdown):

• which versions are you using - Version 8.9.9 (build 56886)
• what are you trying to achieve - Enable SAML Authentication
• what have you tried so far to achieve this - Tried the steps mentioned here SonarQube and SAML authentication with OneLogin and it did not work.

I keep getting multiple error messages when I try to log into Sonarqube via the SAML login.

1. You’re not authorized to access this page. Please contact the administrator.

Fail to callback authentication with 'saml'
java.lang.NullPointerException: urn:oid:2.5.4.42 is missing
        at java.base/java.util.Objects.requireNonNull(Objects.java:246)
        at org.sonar.auth.saml.SamlIdentityProvider.getNonNullFirstAttribute(SamlIdentityProvider.java:166)
        at org.sonar.auth.saml.SamlIdentityProvider.callback(SamlIdentityProvider.java:127)
        at org.sonar.server.authentication.OAuth2CallbackFilter.handleOAuth2Provider(OAuth2CallbackFilter.java:92)
        at org.sonar.server.authentication.OAuth2CallbackFilter.handleProvider(OAuth2CallbackFilter.java:75)
        at org.sonar.server.authentication.OAuth2CallbackFilter.doFilter(OAuth2CallbackFilter.java:68)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139)
        at org.sonar.server.authentication.DefaultAdminCredentialsVerifierFilter.doFilter(DefaultAdminCredentialsVerifierFilter.java:89)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139)
        at org.sonar.server.plugins.PluginsRiskConsentFilter.doFilter(PluginsRiskConsentFilter.java:76)
        at org.sonar.server.platform.web.MasterServletFilter$GodFilterChain.doFilter(MasterServletFilter.java:139)
        at org.sonar.server.platform.web.MasterServletFilter.doFilter(MasterServletFilter.java:108)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:81)
        at org.sonar.server.platform.web.UserSessionFilter.doFilter(UserSessionFilter.java:68)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)
        at org.sonar.server.platform.web.CacheControlFilter.doFilter(CacheControlFilter.java:76)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:194)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:167)

2. You’re not authorized to access this page. Please contact the administrator.

Reason: This account is already associated with another authentication method. Sign in using the current authentication method, or contact your administrator to transfer your account to a different authentication method.

3. You’re not authorized to access this page. Please contact the administrator.
   Reason: The response was received at http://xxxx.domain.com/oauth2/callback/saml instead of https://xxxx.domain.com/oauth2/callback/saml

The 3rd error goes away if I change the recipient URL to HTTP and I am stuck with the 2nd error message now. I don’t know what it means by the different authentication methods.

[Colin]

Hey there.

Error # 1 – You’ve probably defined urn:oid:2.5.4.42 as an attribute in your SAML settings (SonarQube-side) that is missing for a user.

Error #2 – There’s a required action by administrators to migrate existing users from one identity provider to another. Take a look at this guide: Migrating SonarQube Users Between Identity Providers (with a focus on LDAP → SAML) - #2

Error #3 – What are you using (Nginx, Apache, IIS) to serve SonarQube over HTTPS?

[ashokkumarsarma.r]

Hi Colin,

Thanks for getting back. I have seen with the n number of tests that I performed yesterday that the error message keeps changing based on the information updated on the OneLogin side.

Please see the attached screenshot, and it would be great if you could let me know the values for each field.

1. EntityID
2. Recipient
3. ACS URL
4. Login URL

As per the OneLogin SAML connector, only ACS and ACS URL Validator are the required fields. If I fill in those fields, it says I also need to specify the recipient and Login URL. If I mention the Recipient URL, I get Error #3.

We are running Sonarqube as a service on Linux with systemd.

[ashokkumarsarma.r]

This is exactly what I am referring to

Enable SSO for sonarqube 8.4 CE

My company uses Onelogin application for authentication for all internal web application. when i load sonarqube.xyz.com on browser , oneLogin asks for user, password, Duo push and after that it lands to sonarqube login page. my expectation is that after onelogin validation, user should login to SQ. I enabled below settings. still it is not working. sonar.web.sso.enable=true sonar.web.sso.loginHeader=X-Forwarded-Login sonar.web.sso.nameHeader=X-Forwarded-Name sonar.web.sso.emailHeader=X-Forw…

It seems like no one has found the answer or resolution yet.

[ashokkumarsarma.r]

Hi Colin,

We are blocked and cannot go any further with the OneLogin integration. All I need is the field info to complete and test the integration. I am looking forward to your response.

[ashokkumarsarma.r]

Colin,

We are still waiting for your response. Any help here is greatly appreciated.

[ashokkumarsarma.r]

Colin,

It’s been 8 days since I reported this, and I am looking for a small piece of information from you guys. After all the trial and error, this is the only error we get when you try to access Sonarqube via SAML.

"You’re not authorized to access this page. Please contact the administrator.

Reason: This account is already associated with another authentication method. Sign in using the current authentication method, or contact your administrator to transfer your account to a different authentication method."

We do not have any other authentication method configured on the endpoint. Looking for some assistance here.

[Colin]

Hey @ashokkumarsarma.r

This is a community where users have the chance to ask for help, and many users have the chance to contribute. Please make sure to review our FAQ. You’ve also asked for a lot of different pieces of information, but (hopefully?) we’ve landed on just tsis question:

@ashokkumarsarma.r

"You’re not authorized to access this page. Please contact the administrator.

Reason: This account is already associated with another authentication method. Sign in using the current authentication method, or contact your administrator to transfer your account to a different authentication method."

Even if a user has only logged in as a local user before, if the same username attempts to login (via a different authentication provider), the user must be migrated over to the new authentication provider (in this case, SAML).

You could try deleting the existing user in SonarQube, or migrating the user, as noted in this guide:

Migrating SonarQube Users Between Identity Providers (with a focus on LDAP → SAML)

Introduction SonarQube allows delegating authentication to a number of Identity Providers (LDAP, SAML, GitHub, GitLab, etc). It can happen that after some time, a SonarQube administrator may need to change the Identity Provider that their users authenticate with. In particular, there are many organizations making the switch from LDAP Authentication to SAML Authentication for their applications. This guide aims to make it clear how to migrate those users from one Identity Provider to another, f…

[ashokkumarsarma.r]

@Colin

Even if a user has only logged in as a local user before, if the same username attempts to login (via a different authentication provider), the user must be migrated over to the new authentication provider (in this case, SAML).

You could try deleting the existing user in SonarQube, or migrating the user, as noted in this guide

Hey Colin,

That was the issue. I removed the user from Sonarqube and added them on OneLogin. That worked! This is an important information that one should know for the integration or migration to work. I am not sure if this is mentioned clearly in the documentation. Thanks for your help and guidance.