{"record":{"id":"4dcf0f15017d2bf6","repo":"passbolt/passbolt_api","slug":"the-0-configuration-value-should-be-one-of-the-following-1","errorCode":null,"errorMessage":"The {0} configuration value should be one of the following: {1}.","messagePattern":"The (.+?) configuration value should be one of the following: (.+?)\\.","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php","lineNumber":325,"sourceCode":"     * @throws \\Cake\\Http\\Exception\\InternalErrorException When configuration value is invalid.\n     */\n    private function assertJwkDefaultAlg(mixed $defaultAlg): void\n    {\n        if (!is_null($defaultAlg) && !is_string($defaultAlg)) {\n            throw new InternalErrorException(__(\n                'The {0} configuration value should be a string or NULL.',\n                'passbolt.plugins.sso.security.jwks.defaultAlg'\n            ));\n        }\n\n        /**\n         * \"alg\" (Algorithm) Header Parameter Values for JWS.\n         *\n         * @link https://datatracker.ietf.org/doc/html/rfc7518#section-3\n         */\n        $allowedAlgValues = ['HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512', 'ES384', 'ES256'];\n        if (is_string($defaultAlg) && !in_array($defaultAlg, $allowedAlgValues)) {\n            throw new InternalErrorException(__(\n                'The {0} configuration value should be one of the following: {1}.',\n                'passbolt.plugins.sso.security.jwks.defaultAlg',\n                implode(', ', $allowedAlgValues)\n            ));\n        }\n    }\n}\n","sourceCodeStart":307,"sourceCodeEnd":333,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php#L307-L333","documentation":"assertJwkDefaultAlg() also constrains the defaultAlg config to the JWS 'alg' values allowed by RFC 7518 (HS256/384/512, RS256/384/512, ES384, ES256). If passbolt.plugins.sso.security.jwks.defaultAlg is a string but not in this whitelist, getJwtVerificationKeys() throws this InternalErrorException.","triggerScenarios":"Setting passbolt.plugins.sso.security.jwks.defaultAlg to an unsupported string such as 'RS1', 'none', 'PS256', or a lowercase 'rs256'.","commonSituations":"Administrators guessing algorithm names instead of using the documented list; enabling a 'none' algorithm for debugging; typos or case-sensitivity mistakes in config.","solutions":["Set the config to one of: HS256, HS384, HS512, RS256, RS384, RS512, ES384, ES256","Use uppercase exactly as listed (the check is case-sensitive via in_array)","If unsure, remove the config key so NULL is used and the JWK's own alg is respected","Match the algorithm actually used by your IdP for signing id_tokens (commonly RS256)"],"exampleFix":"// before\n'jwks' => ['defaultAlg' => 'PS256'],\n// after\n'jwks' => ['defaultAlg' => 'RS256'],","handlingStrategy":"validation","validationCode":"$allowed = ['HS256','HS384','HS512','RS256','RS384','RS512','ES384','ES256'];\n$defaultAlg = Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg');\nif (is_string($defaultAlg) && !in_array($defaultAlg, $allowed, true)) {\n    throw new \\InvalidArgumentException(\"defaultAlg '$defaultAlg' not allowed; use one of \" . implode(',', $allowed));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the exact uppercase algorithm names from RFC 7518","Match the algorithm your IdP actually signs id_tokens with (usually RS256)","Never set 'none' or unsupported algorithms like PS256","Validate config in staging before production rollout"],"tags":["config","jwks","sso","invalid-value"],"backgroundTag":"invalid-enum-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}