{"record":{"id":"16418b3483b85421","repo":"passbolt/passbolt_api","slug":"client-id-should-be-a-valid-uuid","errorCode":null,"errorMessage":"Client ID should be a valid UUID.","messagePattern":"Client ID should be a valid UUID\\.","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/SmtpSettings/src/Service/SmtpOauthExchangeOnlineService.php","lineNumber":98,"sourceCode":"        $this->username = $config['oauth_username'];\n        // default timeout is 30 (same) but added here for more visibility\n        $this->httpClient = $httpClient ?? new Client(['timeout' => 30]);\n    }\n\n    /**\n     * Add basic data validation check to reduce SSRF risk.\n     * We are not using form class as it can create overhead in this scenario.\n     *\n     * @param array $config Configuration to check.\n     * @return void\n     */\n    private function assertConfiguration(array $config): void\n    {\n        if (!Validation::uuid($config['tenant_id'])) {\n            throw new InternalErrorException(__('Tenant ID should be a valid UUID.'));\n        }\n        if (!Validation::uuid($config['client_id'])) {\n            throw new InternalErrorException(__('Client ID should be a valid UUID.'));\n        }\n    }\n\n    /**\n     * Fetch an OAuth2 access token from Microsoft using client credentials grant.\n     *\n     * @return string The access token.\n     * @throws \\Cake\\Http\\Exception\\InternalErrorException If the token request fails.\n     * @see https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow#get-a-token\n     */\n    public function getAccessToken(): string\n    {\n        $tokenUrl = str_replace('__TENANT_ID__', $this->tenantId, self::LOGIN_TOKEN_URL);\n\n        $response = $this->httpClient->post($tokenUrl, [\n            'grant_type' => 'client_credentials',\n            'client_id' => $this->clientId,\n            'client_secret' => $this->clientSecret,","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/SmtpSettings/src/Service/SmtpOauthExchangeOnlineService.php#L80-L116","documentation":"Thrown by SmtpOauthExchangeOnlineService::assertConfiguration (invoked from the constructor) when the `client_id` in the SMTP OAuth2 configuration for Microsoft Exchange Online is not a valid UUID. This is the Azure AD Application (client) ID and must be a GUID.","triggerScenarios":"Constructing SmtpOauthExchangeOnlineService with smtpSettings OAuth config whose client_id is empty, a client secret pasted by mistake, or the application name instead of the Application (client) ID GUID.","commonSituations":"Copy/paste mistakes in Azure Portal (app name or secret instead of client ID); settings saved with blank client_id; manual DB edits.","solutions":["Copy the Application (client) ID GUID from Azure Portal > App registrations > your app's Overview page.","Re-save the SMTP OAuth settings via the API so validation runs on write.","Double-check you did not paste the client secret or tenant ID into the client_id field (both have distinct formats/uses)."],"exampleFix":"// before\n'client_id' => 'my-exchange-relay-app'\n\n// after\n'client_id' => '0f8a4c9e-1d2b-4e3f-9a8b-7c6d5e4f3a2b'","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\nif (!Validation::uuid($config['client_id'] ?? '')) {\n    throw new InvalidArgumentException('client_id must be a UUID');\n}","typeGuard":"function isClientIdValid(mixed $clientId): bool {\n    return is_string($clientId) && Cake\\Validation\\Validation::uuid($clientId);\n}","tryCatchPattern":"try {\n    $service = new SmtpOauthExchangeOnlineService($config);\n} catch (InternalErrorException $e) {\n    // config error: client_id is not a UUID\n}","preventionTips":["Copy the Application (client) ID from Azure App registrations Overview, not the app name or secret.","Validate both tenant_id and client_id as UUIDs before saving settings.","Use the settings API for writes so constructor-level validation errors surface early.","Review stored OAuth config after manual database interventions."],"tags":["oauth","azure","smtp","uuid","configuration"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}