{"record":{"id":"0c0e908251d32471","repo":"passbolt/passbolt_api","slug":"the-sso-authentication-token-is-invalid-settings-id-is","errorCode":null,"errorMessage":"The SSO authentication token is invalid. Settings id is missing.","messagePattern":"The SSO authentication token is invalid\\. Settings id is missing\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php","lineNumber":180,"sourceCode":"     * @param \\App\\Utility\\ExtendedUserAccessControl $uac user access control\n     * @param string $settingsId uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the authentication is expired\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user agent or IP are missing or not matching\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the SSO settings is not valid or not matching\n     * @return void\n     */\n    public function assert(SsoAuthenticationToken $token, ExtendedUserAccessControl $uac, string $settingsId): void\n    {\n        $errorMsg = __('The SSO authentication token is invalid.') . ' ';\n\n        if ($token->isExpired()) {\n            throw new BadRequestException($errorMsg . __('The authentication token is expired.'));\n        }\n\n        try {\n            $sid = $token->getDataProperty(SsoAuthenticationToken::DATA_SSO_SETTING_ID);\n        } catch (AuthenticationTokenDataPropertyException $exception) {\n            throw new BadRequestException($errorMsg . __('Settings id is missing.'), 400, $exception);\n        }\n\n        if ($token->user_id !== $uac->getId() || !Validation::uuid($token->user_id)) {\n            throw new BadRequestException($errorMsg . __('User id mismatch.'));\n        }\n\n        if (Configure::read('passbolt.security.userIp')) {\n            try {\n                $ip = $token->getDataProperty(SsoAuthenticationToken::DATA_IP);\n            } catch (AuthenticationTokenDataPropertyException $exception) {\n                throw new BadRequestException($errorMsg . __('Token IP is missing.'), 400, $exception);\n            }\n\n            if ($ip !== $uac->getUserIp()) {\n                throw new BadRequestException($errorMsg . __('User IP mismatch.'));\n            }\n        }\n","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoAuthenticationTokens/SsoAuthenticationTokenGetService.php#L162-L198","documentation":"A BadRequestException from assert() when the token's data payload lacks the required 'sso_setting_id' data property. SSO tokens carry metadata (settings id, IP, user agent) in their data JSON; getDataProperty() throws AuthenticationTokenDataPropertyException if the key is absent.","triggerScenarios":"assert()/assertAndConsume() is called on a token whose data property DATA_SSO_SETTING_ID is missing — e.g. the token was created without SSO settings data, the data JSON was truncated, or a plain authentication token is mistakenly processed by the SSO assert path.","commonSituations":"Migrating data from pre-SSO-settings token format; manually seeded test tokens without a data payload; version skew where old tokens (created before a migration added the property) are still in circulation; passing a generic AuthenticationToken instead of an SsoAuthenticationToken.","solutions":["Ensure the token is created via the SSO token creation service which populates the sso_setting_id data property","Delete/expire stale tokens from before the SSO settings migration and restart the flow","Confirm the row's data JSON actually contains the settings id (inspect sso_authentication_tokens.data)","Verify you are handling an SsoAuthenticationToken entity, not a base AuthenticationToken"],"exampleFix":"// before\n$token->getDataProperty(SsoAuthenticationToken::DATA_SSO_SETTING_ID); // throws if missing\n// after\nif (!$token->hasDataProperty(SsoAuthenticationToken::DATA_SSO_SETTING_ID)) {\n    throw new BadRequestException(__('The SSO authentication token is invalid. Settings id is missing.'));\n}\n$sid = $token->getDataProperty(SsoAuthenticationToken::DATA_SSO_SETTING_ID);","handlingStrategy":"validation","validationCode":"$hasSettings = $token->hasDataProperty(\\Passbolt\\Sso\\Model\\Entity\\SsoAuthenticationToken::DATA_SSO_SETTING_ID);","typeGuard":"function hasSsoSettingsId(SsoAuthenticationToken $t): bool {\n    return $t->hasDataProperty(SsoAuthenticationToken::DATA_SSO_SETTING_ID);\n}","tryCatchPattern":"try {\n    $service->assertAndConsume($token, $uac, $settingsId);\n} catch (\\Cake\\Http\\Exception\\BadRequestException $e) {\n    if (str_contains($e->getMessage(), 'Settings id is missing')) {\n        // recreate token via the SSO token creation service\n    }\n}","preventionTips":["Only create SSO tokens via the dedicated creation service that populates data properties","Purge pre-migration tokens lacking data payloads","Inspect the data JSON column when debugging"],"tags":["sso","missing-data","token-validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}