[JENKINS-75889] GitHub app authentication fails when app is installed at both enterprise and org level #1467
Description
When using a GitHub App that is installed on both an enterprise AND an organisation, the authentication fails with:
09:22:44 hudson.remoting.ProxyException: com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of type `org.kohsuke.github.GHTargetType` from String "Enterprise": not one of the values accepted for Enum class: [ORGANIZATION, USER] 09:22:44 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 789] (through reference chain: java.lang.Object[][0]->org.kohsuke.github.GHAppInstallation["target_type"]) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.exc.InvalidFormatException.from(InvalidFormatException.java:67) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.DeserializationContext.weirdStringException(DeserializationContext.java:1986) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.DeserializationContext.handleWeirdStringValue(DeserializationContext.java:1272) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer._deserializeAltString(EnumDeserializer.java:446) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer._fromString(EnumDeserializer.java:303) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer.deserialize(EnumDeserializer.java:272) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:137) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:392) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.ObjectArrayDeserializer.deserialize(ObjectArrayDeserializer.java:217) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:342) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.ObjectReader._bindAndClose(ObjectReader.java:2130) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.ObjectReader.readValue(ObjectReader.java:1565) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubResponse.parseBody(GitHubResponse.java:104) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.lambda$fetch$0(GitHubPageIterator.java:147) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.createResponse(GitHubClient.java:679) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:466) 09:22:44 Caused: hudson.remoting.ProxyException: org.kohsuke.github.HttpException: Server returned HTTP response code: 200, message: 'null' for URL: https://api.github.com/app/installations 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.interpretApiError(GitHubClient.java:743) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:480) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.fetch(GitHubPageIterator.java:146) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.hasNext(GitHubPageIterator.java:93) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterator.fetch(PagedIterator.java:116) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterator.nextPageArray(PagedIterator.java:144) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toArray(PagedIterable.java:79) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toArray(PagedIterable.java:107) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toList(PagedIterable.java:119) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.asList(PagedIterable.java:144) 09:22:44 Also: hudson.remoting.ProxyException: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: a7cab8f2-e679-4040-b830-b0b0cffeedfd 09:22:44 Caused: hudson.remoting.ProxyException: org.kohsuke.github.GHException: Failed to retrieve list: Server returned HTTP response code: 200, message: 'null' for URL: https://api.github.com/app/installations 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.asList(PagedIterable.java:146) 09:22:44 at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.generateAppInstallationToken(GitHubAppCredentials.java:222) 09:22:44 at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.getToken(GitHubAppCredentials.java:294) 09:22:44 at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.getPassword(GitHubAppCredentials.java:323) 09:22:44 at PluginClassLoader for credentials-binding//org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding.bind(UsernamePasswordMultiBinding.java:77) 09:22:44 at PluginClassLoader for credentials-binding//org.jenkinsci.plugins.credentialsbinding.impl.BindingStep$Execution2.doStart(BindingStep.java:133) 09:22:44 at PluginClassLoader for workflow-step-api//org.jenkinsci.plugins.workflow.steps.GeneralNonBlockingStepExecution.lambda$run$0(GeneralNonBlockingStepExecution.java:77) 09:22:44 at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) 09:22:44 at java.base/java.util.concurrent.FutureTask.run(Unknown Source) 09:22:44 at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) 09:22:44 at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) 09:22:44 at java.base/java.lang.Thread.run(Unknown Source) 09:22:45 Finished: FAILURE
This happens even when the "Owner" field is set to the organisation name within the Jenkins credential. Interestingly, we don't see this error when testing the connection on the credential page. Only when running a pipeline job that uses the credential.
If we set the "Owner" field on the credential, we'd expect this organisation to be used when consuming the credential in a pipeline job. However, it appears this field is ignored within the pipeline job but is used when testing the credential?
Steps to reproduce:
- Create a GitHub app and install it on BOTH an enterprise and organisation
- Configure the GitHub app credential in Jenkins as follows. The "Owner" field should be set to the name of the GitHub organisation the app is installed on
3. Hit "Test Connection" and the test is successful
4. Try to use the credential in a pipeline job and you'll get the error message mentioned above
Originally reported by brandon, imported from: GitHub app authentication fails when app is installed at both enterprise and org level
- status: Open
- priority: Minor
- component(s): github-branch-source-plugin
- resolution: Unresolved
- votes: 0
- watchers: 1
- imported: 2025-12-02
Raw content of original issue
When using a GitHub App that is installed on both an enterprise AND an organisation, the authentication fails with:
09:22:44 hudson.remoting.ProxyException: com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of type `org.kohsuke.github.GHTargetType` from String "Enterprise": not one of the values accepted for Enum class: [ORGANIZATION, USER] 09:22:44 at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 789] (through reference chain: java.lang.Object[][0]->org.kohsuke.github.GHAppInstallation["target_type"]) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.exc.InvalidFormatException.from(InvalidFormatException.java:67) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.DeserializationContext.weirdStringException(DeserializationContext.java:1986) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.DeserializationContext.handleWeirdStringValue(DeserializationContext.java:1272) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer._deserializeAltString(EnumDeserializer.java:446) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer._fromString(EnumDeserializer.java:303) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.EnumDeserializer.deserialize(EnumDeserializer.java:272) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:137) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.BeanDeserializer.deserializeFromObject(BeanDeserializer.java:392) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.std.ObjectArrayDeserializer.deserialize(ObjectArrayDeserializer.java:217) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:342) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.ObjectReader._bindAndClose(ObjectReader.java:2130) 09:22:44 at PluginClassLoader for jackson2-api//com.fasterxml.jackson.databind.ObjectReader.readValue(ObjectReader.java:1565) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubResponse.parseBody(GitHubResponse.java:104) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.lambda$fetch$0(GitHubPageIterator.java:147) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.createResponse(GitHubClient.java:679) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:466) 09:22:44 Caused: hudson.remoting.ProxyException: org.kohsuke.github.HttpException: Server returned HTTP response code: 200, message: 'null' for URL: https://api.github.com/app/installations 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.interpretApiError(GitHubClient.java:743) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubClient.sendRequest(GitHubClient.java:480) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.fetch(GitHubPageIterator.java:146) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.GitHubPageIterator.hasNext(GitHubPageIterator.java:93) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterator.fetch(PagedIterator.java:116) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterator.nextPageArray(PagedIterator.java:144) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toArray(PagedIterable.java:79) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toArray(PagedIterable.java:107) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.toList(PagedIterable.java:119) 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.asList(PagedIterable.java:144) 09:22:44 Also: hudson.remoting.ProxyException: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: a7cab8f2-e679-4040-b830-b0b0cffeedfd 09:22:44 Caused: hudson.remoting.ProxyException: org.kohsuke.github.GHException: Failed to retrieve list: Server returned HTTP response code: 200, message: 'null' for URL: https://api.github.com/app/installations 09:22:44 at PluginClassLoader for github-api//org.kohsuke.github.PagedIterable.asList(PagedIterable.java:146) 09:22:44 at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.generateAppInstallationToken(GitHubAppCredentials.java:222) 09:22:44 at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.getToken(GitHubAppCredentials.java:294) 09:22:44 at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.getPassword(GitHubAppCredentials.java:323) 09:22:44 at PluginClassLoader for credentials-binding//org.jenkinsci.plugins.credentialsbinding.impl.UsernamePasswordMultiBinding.bind(UsernamePasswordMultiBinding.java:77) 09:22:44 at PluginClassLoader for credentials-binding//org.jenkinsci.plugins.credentialsbinding.impl.BindingStep$Execution2.doStart(BindingStep.java:133) 09:22:44 at PluginClassLoader for workflow-step-api//org.jenkinsci.plugins.workflow.steps.GeneralNonBlockingStepExecution.lambda$run$0(GeneralNonBlockingStepExecution.java:77) 09:22:44 at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) 09:22:44 at java.base/java.util.concurrent.FutureTask.run(Unknown Source) 09:22:44 at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) 09:22:44 at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) 09:22:44 at java.base/java.lang.Thread.run(Unknown Source) 09:22:45 Finished: FAILUREThis happens even when the "Owner" field is set to the organisation name within the Jenkins credential. Interestingly, we don't see this error when testing the connection on the credential page. Only when running a pipeline job that uses the credential.
If we set the "Owner" field on the credential, we'd expect this organisation to be used when consuming the credential in a pipeline job. However, it appears this field is ignored within the pipeline job but is used when testing the credential?
Steps to reproduce:
- Create a GitHub app and install it on BOTH an enterprise and organisation
- Configure the GitHub app credential in Jenkins as follows. The "Owner" field should be set to the name of the GitHub organisation the app is installed on
3. Hit "Test Connection" and the test is successful
4. Try to use the credential in a pipeline job and you'll get the error message mentioned above
environment
Jenkins: 2.504.3<br/>
OS: Linux - 5.15.0-1091-azure<br/>
Java: 17.0.15 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)<br/>
---<br/>
Office-365-Connector:5.1.0<br/>
ansicolor:1.0.6<br/>
antisamy-markup-formatter:173.v680e3a_b_69ff3<br/>
apache-httpcomponents-client-4-api:4.5.14-269.vfa_2321039a_83<br/>
apache-httpcomponents-client-5-api:5.5-150.veb_76e719855b_<br/>
asm-api:9.8-135.vb_2239d08ee90<br/>
atlassian-jira-software-cloud:2.0.15<br/>
audit-trail:395.vce180b_359a_b_5<br/>
authentication-tokens:1.131.v7199556c3004<br/>
authorize-project:2.0.0<br/>
azure-credentials:357.v6447d38fb_007<br/>
azure-keyvault:282.v43b_691a_13d19<br/>
azure-sdk:223.vff769b_ce66b_b_<br/>
azure-vm-agents:1026.v6b_6edb_b_e3fff<br/>
bitbucket:273.v7b_535e8f11c2<br/>
bitbucket-oauth:0.14<br/>
bootstrap5-api:5.3.7-1<br/>
bouncycastle-api:2.30.1.80-261.v00c0e2618ec3<br/>
branch-api:2.1233.vfb_6b_2b_3ed499<br/>
build-timeout:1.38<br/>
caffeine-api:3.2.0-166.v72a_6d74b_870f<br/>
checks-api:373.vfe7645102093<br/>
cloud-stats:377.vd8a_6c953e98e<br/>
cloudbees-bitbucket-branch-source:936.4.3<br/>
cloudbees-folder:6.1036.vb_94fd035b_287<br/>
command-launcher:123.v37cfdc92ef67<br/>
commons-collections4-api:4.5.0-8.va_d5448ef9011<br/>
commons-lang3-api:3.18.0-98.v3a_674c06072d<br/>
commons-text-api:1.13.1-176.v74d88f22034b_<br/>
configuration-as-code:1971.vf9280461ea_89<br/>
copyartifact:770.va_6c69e063442<br/>
credentials:1415.v831096eb_5534<br/>
credentials-binding:696.v256688029804<br/>
dark-theme:524.vd675b_22b_30cb_<br/>
display-url-api:2.209.v582ed814ff2f<br/>
durable-task:587.v84b_877235b_45<br/>
echarts-api:5.6.0-5<br/>
eddsa-api:0.3.0.1-19.vc432d923e5ee<br/>
email-ext:1916.vc954a_f86ff21<br/>
extended-read-permission:61.vf24570ff3b_e9<br/>
favorite:2.237.v79163ca_8b_892<br/>
folder-properties:62.v1636b_4a_84608<br/>
font-awesome-api:6.7.2-1<br/>
generic-webhook-trigger:2.3.1<br/>
git:5.7.0<br/>
git-client:6.2.0<br/>
github:1.43.0<br/>
github-api:1.321-488.v9b_c0da_9533f8<br/>
github-branch-source:1824.v046257273408<br/>
groovy:497.v7b_061a_a_de65d<br/>
gson-api:2.13.1-139.v4569c2ef303f<br/>
handy-uri-templates-2-api:2.1.8-36.v85e4cb_234a_13<br/>
instance-identity:203.v15e81a_1b_7a_38<br/>
ionicons-api:88.va_4187cb_eddf1<br/>
jackson2-api:2.19.0-404.vb_b_0fd2fea_e10<br/>
jakarta-activation-api:2.1.3-2<br/>
jakarta-mail-api:2.1.3-2<br/>
javax-activation-api:1.2.0-8<br/>
javax-mail-api:1.6.2-11<br/>
jaxb:2.3.9-133.vb_ec76a_73f706<br/>
jdk-tool:83.v417146707a_3d<br/>
jersey2-api:2.47-165.ve7809a_3e87e0<br/>
jira:3.18<br/>
jjwt-api:0.11.5-120.v0268cf544b_89<br/>
job-dsl:1.93<br/>
jobConfigHistory:1330.vcb_8320ea_cdb_e<br/>
joda-time-api:2.14.0-127.v7d9da_295a_d51<br/>
jquery3-api:3.7.1-3<br/>
jsch:0.2.16-95.v3eecb_55fa_b_78<br/>
json-api:20250517-153.vc8a_a_d87c0ce3<br/>
json-path-api:2.9.0-148.v22a_7ffe323ce<br/>
jsoup:1.21.1-52.v96e4041b_60fd<br/>
junit:1335.v6b_a_a_e18534e1<br/>
kubernetes:4358.vcfd9c5a_0a_f51<br/>
kubernetes-client-api:7.3.1-256.v788a_0b_787114<br/>
kubernetes-credentials:203.v85b_9836a_f44b_<br/>
kubernetes-credentials-provider:1.290.ve56494531260<br/>
ldap:780.vcb_33c9a_e4332<br/>
mailer:509.vc54d23fc427e<br/>
matrix-auth:3.2.6<br/>
matrix-project:849.v0cd64ed7e531<br/>
mercurial:1309.v6802b_f0efb_b_9<br/>
metrics:4.2.32-476.v5042e1c1edd7<br/>
mina-sshd-api-common:2.15.0-161.vb_200831a_c15b_<br/>
mina-sshd-api-core:2.15.0-161.vb_200831a_c15b_<br/>
naginator:1.504.vfc3736332f16<br/>
netty-api:4.1.118.Final-9.v776038d601a_7<br/>
okhttp-api:4.11.0-189.v976fa_d3379d6<br/>
parameterized-scheduler:285.ve611986d4c48<br/>
pipeline-build-step:571.v08a_fffd4b_0ce<br/>
pipeline-graph-analysis:241.vc3d48fb_b_2582<br/>
pipeline-groovy-lib:752.vdddedf804e72<br/>
pipeline-input-step:527.vd61b_1d3c5078<br/>
pipeline-milestone-step:138.v78ca_76831a_43<br/>
pipeline-model-api:2.2255.v56a_15e805f12<br/>
pipeline-model-definition:2.2255.v56a_15e805f12<br/>
pipeline-model-extensions:2.2255.v56a_15e805f12<br/>
pipeline-rest-api:2.38<br/>
pipeline-stage-step:322.vecffa_99f371c<br/>
pipeline-stage-tags-metadata:2.2255.v56a_15e805f12<br/>
pipeline-stage-view:2.38<br/>
plain-credentials:199.v9f8e1f741799<br/>
plugin-usage-plugin:4.10<br/>
plugin-util-api:6.1.0<br/>
prism-api:1.30.0-1<br/>
resource-disposer:0.25<br/>
role-strategy:785.v8d262df0f607<br/>
scm-api:704.v3ce5c542825a_<br/>
script-security:1373.vb_b_4a_a_c26fa_00<br/>
snakeyaml-api:2.3-125.v4d77857a_b_402<br/>
splunk-devops:1.11.0<br/>
splunk-devops-extend:1.11.0<br/>
ssh-credentials:359.v2191c4cf635f<br/>
ssh-slaves:3.1031.v72c6b_883b_869<br/>
sshd:3.372.v5d04a_e92d8cf<br/>
structs:350.v3b_30f09f2363<br/>
theme-manager:313.v8657a_a_7692cb_<br/>
timestamper:1.30<br/>
token-macro:444.v52de7e9c573d<br/>
trilead-api:2.209.v0e69b_c43c245<br/>
variant:70.va_d9f17f859e0<br/>
versioncolumn:320.v6b_b_814ca_01f7<br/>
workflow-aggregator:608.v67378e9d3db_1<br/>
workflow-api:1373.v7b_813f10efa_b_<br/>
workflow-basic-steps:1079.vce64b_a_929c5a_<br/>
workflow-cps:4151.v5406e29e3c90<br/>
workflow-durable-task-step:1434.v1b_595c29ddd7<br/>
workflow-job:1540.v295eccc9778f<br/>
workflow-multibranch:806.vb_b_688f609ee9<br/>
workflow-scm-step:437.v05a_f66b_e5ef8<br/>
workflow-step-api:704.ve4f0967e98fa_<br/>
workflow-support:968.v8f17397e87b_8<br/>
ws-cleanup:0.48
