jenkinsci / jenkinsci/github-branch-source-plugin

[JENKINS-75889] GitHub app authentication fails when app is installed at both enterprise and org level

Open
#1,467 0 comments 0 reactions 0 assignees View on GitHub
component:github-branch-source-plugin imported-jira-issue priority:minor resolution:unresolved
Dominant language
Java
Stars
217
Forks
398
Avg merge
30m
Merged PRs (30d)
1

Description

When using a GitHub App that is installed on both an enterprise AND an organisation, the authentication fails with:

09:22:44  hudson.remoting.ProxyException: com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of type `org.kohsuke.github.GHTargetType` from String "Enterprise": not one of the values accepted for Enum class: [ORGANIZATION, USER]

09:22:44   at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 789] (through reference chain: java.lang.Object[][0]->org.kohsuke.github.GHAppInstallation["target_type"])

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.exc.InvalidFormatException.from(InvalidFormatException.java:67)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.DeserializationContext.weirdStringException(DeserializationContext.java:1986)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.DeserializationContext.handleWeirdStringValue(DeserializationContext.java:1272)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer._deserializeAltString(EnumDeserializer.java:446)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer._fromString(EnumDeserializer.java:303)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer.deserialize(EnumDeserializer.java:272)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:137)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:392)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.ObjectArrayDeserializer.deserialize(ObjectArrayDeserializer.java:217)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:342)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.ObjectReader._bindAndClose(ObjectReader.java:2130)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.ObjectReader.readValue(ObjectReader.java:1565)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubResponse.parseBody(GitHubResponse.java:104)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.lambda$fetch$0(GitHubPageIterator.java:147)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.createResponse(GitHubClient.java:679)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:466)

09:22:44  Caused: hudson.remoting.ProxyException: org.kohsuke.github.HttpException: Server returned HTTP response code: 200, message: 'null' for URL: https://api.github.com/app/installations

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.interpretApiError(GitHubClient.java:743)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:480)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.fetch(GitHubPageIterator.java:146)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.hasNext(GitHubPageIterator.java:93)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterator.fetch(PagedIterator.java:116)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterator.nextPageArray(PagedIterator.java:144)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toArray(PagedIterable.java:79)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toArray(PagedIterable.java:107)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toList(PagedIterable.java:119)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.asList(PagedIterable.java:144)

09:22:44  Also:   hudson.remoting.ProxyException: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: a7cab8f2-e679-4040-b830-b0b0cffeedfd

09:22:44  Caused: hudson.remoting.ProxyException: org.kohsuke.github.GHException: Failed to retrieve list: Server returned HTTP response code: 200, message: 'null' for URL: https://api.github.com/app/installations

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.asList(PagedIterable.java:146)

09:22:44  	at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.generateAppInstallationToken(GitHubAppCredentials.java:222)

09:22:44  	at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.getToken(GitHubAppCredentials.java:294)

09:22:44  	at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.getPassword(GitHubAppCredentials.java:323)

09:22:44  	at PluginClassLoader for credentials-binding//org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding.bind(UsernamePasswordMultiBinding.java:77)

09:22:44  	at PluginClassLoader for credentials-binding//org.jenkinsci.plugins.credentialsbinding.impl.BindingStep$Execution2.doStart(BindingStep.java:133)

09:22:44  	at PluginClassLoader for workflow-step-api//org.jenkinsci.plugins.workflow.steps.GeneralNonBlockingStepExecution.lambda$run$0(GeneralNonBlockingStepExecution.java:77)

09:22:44  	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)

09:22:44  	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)

09:22:44  	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

09:22:44  	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

09:22:44  	at java.base/java.lang.Thread.run(Unknown Source)

09:22:45  Finished: FAILURE

This happens even when the "Owner" field is set to the organisation name within the Jenkins credential. Interestingly, we don't see this error when testing the connection on the credential page. Only when running a pipeline job that uses the credential.

If we set the "Owner" field on the credential, we'd expect this organisation to be used when consuming the credential in a pipeline job. However, it appears this field is ignored within the pipeline job but is used when testing the credential? 

Steps to reproduce:



  1. Create a GitHub app and install it on BOTH an enterprise and organisation

  2. Configure the GitHub app credential in Jenkins as follows. The "Owner" field should be set to the name of the GitHub organisation the app is installed on

3. Hit "Test Connection" and the test is successful

4. Try to use the credential in a pipeline job and you'll get the error message mentioned above

 

---
Originally reported by brandon, imported from: GitHub app authentication fails when app is installed at both enterprise and org level


  • status: Open
  • priority: Minor
  • component(s): github-branch-source-plugin
  • resolution: Unresolved
  • votes: 0
  • watchers: 1
  • imported: 2025-12-02

Raw content of original issue

When using a GitHub App that is installed on both an enterprise AND an organisation, the authentication fails with:




09:22:44  hudson.remoting.ProxyException: com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of type `org.kohsuke.github.GHTargetType` from String "Enterprise": not one of the values accepted for Enum class: [ORGANIZATION, USER]

09:22:44   at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 789] (through reference chain: java.lang.Object[][0]->org.kohsuke.github.GHAppInstallation["target_type"])

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.exc.InvalidFormatException.from(InvalidFormatException.java:67)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.DeserializationContext.weirdStringException(DeserializationContext.java:1986)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.DeserializationContext.handleWeirdStringValue(DeserializationContext.java:1272)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer._deserializeAltString(EnumDeserializer.java:446)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer._fromString(EnumDeserializer.java:303)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer.deserialize(EnumDeserializer.java:272)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:137)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:392)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.ObjectArrayDeserializer.deserialize(ObjectArrayDeserializer.java:217)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:342)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.ObjectReader._bindAndClose(ObjectReader.java:2130)

09:22:44  	at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.ObjectReader.readValue(ObjectReader.java:1565)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubResponse.parseBody(GitHubResponse.java:104)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.lambda$fetch$0(GitHubPageIterator.java:147)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.createResponse(GitHubClient.java:679)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:466)

09:22:44  Caused: hudson.remoting.ProxyException: org.kohsuke.github.HttpException: Server returned HTTP response code: 200, message: 'null' for URL: https://api.github.com/app/installations

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.interpretApiError(GitHubClient.java:743)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:480)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.fetch(GitHubPageIterator.java:146)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.hasNext(GitHubPageIterator.java:93)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterator.fetch(PagedIterator.java:116)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterator.nextPageArray(PagedIterator.java:144)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toArray(PagedIterable.java:79)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toArray(PagedIterable.java:107)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toList(PagedIterable.java:119)

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.asList(PagedIterable.java:144)

09:22:44  Also:   hudson.remoting.ProxyException: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: a7cab8f2-e679-4040-b830-b0b0cffeedfd

09:22:44  Caused: hudson.remoting.ProxyException: org.kohsuke.github.GHException: Failed to retrieve list: Server returned HTTP response code: 200, message: 'null' for URL: https://api.github.com/app/installations

09:22:44  	at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.asList(PagedIterable.java:146)

09:22:44  	at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.generateAppInstallationToken(GitHubAppCredentials.java:222)

09:22:44  	at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.getToken(GitHubAppCredentials.java:294)

09:22:44  	at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.getPassword(GitHubAppCredentials.java:323)

09:22:44  	at PluginClassLoader for credentials-binding//org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding.bind(UsernamePasswordMultiBinding.java:77)

09:22:44  	at PluginClassLoader for credentials-binding//org.jenkinsci.plugins.credentialsbinding.impl.BindingStep$Execution2.doStart(BindingStep.java:133)

09:22:44  	at PluginClassLoader for workflow-step-api//org.jenkinsci.plugins.workflow.steps.GeneralNonBlockingStepExecution.lambda$run$0(GeneralNonBlockingStepExecution.java:77)

09:22:44  	at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)

09:22:44  	at java.base/java.util.concurrent.FutureTask.run(Unknown Source)

09:22:44  	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

09:22:44  	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

09:22:44  	at java.base/java.lang.Thread.run(Unknown Source)

09:22:45  Finished: FAILURE




This happens even when the "Owner" field is set to the organisation name within the Jenkins credential. Interestingly, we don't see this error when testing the connection on the credential page. Only when running a pipeline job that uses the credential.



If we set the "Owner" field on the credential, we'd expect this organisation to be used when consuming the credential in a pipeline job. However, it appears this field is ignored within the pipeline job but is used when testing the credential? 



Steps to reproduce:


    

    	
  1. Create a GitHub app and install it on BOTH an enterprise and organisation
    2. 

    	
  2. Configure the GitHub app credential in Jenkins as follows. The "Owner" field should be set to the name of the GitHub organisation the app is installed on
    3. 







3. Hit "Test Connection" and the test is successful



4. Try to use the credential in a pipeline job and you'll get the error message mentioned above



 

environment

```
Jenkins: 2.504.3

OS: Linux - 5.15.0-1091-azure

Java: 17.0.15 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)

---

Office-365-Connector:5.1.0

ansicolor:1.0.6

antisamy-markup-formatter:173.v680e3a_b_69ff3

apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83

apache-httpcomponents-client-5-api:5.5-150.veb_76e719855b_

asm-api:9.8-135.vb_2239d08ee90

atlassian-jira-software-cloud:2.0.15

audit-trail:395.vce180b_359a_b_5

authentication-tokens:1.131.v7199556c3004

authorize-project:2.0.0

azure-credentials:357.v6447d38fb_007

azure-keyvault:282.v43b_691a_13d19

azure-sdk:223.vff769b_ce66b_b_

azure-vm-agents:1026.v6b_6edb_b_e3fff

bitbucket:273.v7b_535e8f11c2

bitbucket-oauth:0.14

bootstrap5-api:5.3.7-1

bouncycastle-api:2.30.1.80-261.v00c0e2618ec3

branch-api:2.1233.vfb_6b_2b_3ed499

build-timeout:1.38

caffeine-api:3.2.0-166.v72a_6d74b_870f

checks-api:373.vfe7645102093

cloud-stats:377.vd8a_6c953e98e

cloudbees-bitbucket-branch-source:936.4.3

cloudbees-folder:6.1036.vb_94fd035b_287

command-launcher:123.v37cfdc92ef67

commons-collections4-api:4.5.0-8.va_d5448ef9011

commons-lang3-api:3.18.0-98.v3a_674c06072d

commons-text-api:1.13.1-176.v74d88f22034b_

configuration-as-code:1971.vf9280461ea_89

copyartifact:770.va_6c69e063442

credentials:1415.v831096eb_5534

credentials-binding:696.v256688029804

dark-theme:524.vd675b_22b_30cb_

display-url-api:2.209.v582ed814ff2f

durable-task:587.v84b_877235b_45

echarts-api:5.6.0-5

eddsa-api:0.3.0.1-19.vc432d923e5ee

email-ext:1916.vc954a_f86ff21

extended-read-permission:61.vf24570ff3b_e9

favorite:2.237.v79163ca_8b_892

folder-properties:62.v1636b_4a_84608

font-awesome-api:6.7.2-1

generic-webhook-trigger:2.3.1

git:5.7.0

git-client:6.2.0

github:1.43.0

github-api:1.321-488.v9b_c0da_9533f8

github-branch-source:1824.v046257273408

groovy:497.v7b_061a_a_de65d

gson-api:2.13.1-139.v4569c2ef303f

handy-uri-templates-2-api:2.1.8-36.v85e4cb_234a_13

instance-identity:203.v15e81a_1b_7a_38

ionicons-api:88.va_4187cb_eddf1

jackson2-api:2.19.0-404.vb_b_0fd2fea_e10

jakarta-activation-api:2.1.3-2

jakarta-mail-api:2.1.3-2

javax-activation-api:1.2.0-8

javax-mail-api:1.6.2-11

jaxb:2.3.9-133.vb_ec76a_73f706

jdk-tool:83.v417146707a_3d

jersey2-api:2.47-165.ve7809a_3e87e0

jira:3.18

jjwt-api:0.11.5-120.v0268cf544b_89

job-dsl:1.93

jobConfigHistory:1330.vcb_8320ea_cdb_e

joda-time-api:2.14.0-127.v7d9da_295a_d51

jquery3-api:3.7.1-3

jsch:0.2.16-95.v3eecb_55fa_b_78

json-api:20250517-153.vc8a_a_d87c0ce3

json-path-api:2.9.0-148.v22a_7ffe323ce

jsoup:1.21.1-52.v96e4041b_60fd

junit:1335.v6b_a_a_e18534e1

kubernetes:4358.vcfd9c5a_0a_f51

kubernetes-client-api:7.3.1-256.v788a_0b_787114

kubernetes-credentials:203.v85b_9836a_f44b_

kubernetes-credentials-provider:1.290.ve56494531260

ldap:780.vcb_33c9a_e4332

mailer:509.vc54d23fc427e

matrix-auth:3.2.6

matrix-project:849.v0cd64ed7e531

mercurial:1309.v6802b_f0efb_b_9

metrics:4.2.32-476.v5042e1c1edd7

mina-sshd-api-common:2.15.0-161.vb_200831a_c15b_

mina-sshd-api-core:2.15.0-161.vb_200831a_c15b_

naginator:1.504.vfc3736332f16

netty-api:4.1.118.Final-9.v776038d601a_7

okhttp-api:4.11.0-189.v976fa_d3379d6

parameterized-scheduler:285.ve611986d4c48

pipeline-build-step:571.v08a_fffd4b_0ce

pipeline-graph-analysis:241.vc3d48fb_b_2582

pipeline-groovy-lib:752.vdddedf804e72

pipeline-input-step:527.vd61b_1d3c5078

pipeline-milestone-step:138.v78ca_76831a_43

pipeline-model-api:2.2255.v56a_15e805f12

pipeline-model-definition:2.2255.v56a_15e805f12

pipeline-model-extensions:2.2255.v56a_15e805f12

pipeline-rest-api:2.38

pipeline-stage-step:322.vecffa_99f371c

pipeline-stage-tags-metadata:2.2255.v56a_15e805f12

pipeline-stage-view:2.38

plain-credentials:199.v9f8e1f741799

plugin-usage-plugin:4.10

plugin-util-api:6.1.0

prism-api:1.30.0-1

resource-disposer:0.25

role-strategy:785.v8d262df0f607

scm-api:704.v3ce5c542825a_

script-security:1373.vb_b_4a_a_c26fa_00

snakeyaml-api:2.3-125.v4d77857a_b_402

splunk-devops:1.11.0

splunk-devops-extend:1.11.0

ssh-credentials:359.v2191c4cf635f

ssh-slaves:3.1031.v72c6b_883b_869

sshd:3.372.v5d04a_e92d8cf

structs:350.v3b_30f09f2363

theme-manager:313.v8657a_a_7692cb_

timestamper:1.30

token-macro:444.v52de7e9c573d

trilead-api:2.209.v0e69b_c43c245

variant:70.va_d9f17f859e0

versioncolumn:320.v6b_b_814ca_01f7

workflow-aggregator:608.v67378e9d3db_1

workflow-api:1373.v7b_813f10efa_b_

workflow-basic-steps:1079.vce64b_a_929c5a_

workflow-cps:4151.v5406e29e3c90

workflow-durable-task-step:1434.v1b_595c29ddd7

workflow-job:1540.v295eccc9778f

workflow-multibranch:806.vb_b_688f609ee9

workflow-scm-step:437.v05a_f66b_e5ef8

workflow-step-api:704.ve4f0967e98fa_

workflow-support:968.v8f17397e87b_8

ws-cleanup:0.48
```

1 attachment

- [image-2025-07-16-09-34-20-880.png](https://issues.jenkins.io/secure/attachment/64674/image-2025-07-16-09-34-20-880.png)
> ![image-2025-07-16-09-34-20-880.png](https://issues.jenkins.io/secure/attachment/64674/image-2025-07-16-09-34-20-880.png)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.