{"record":{"id":"50e4148c2938d098","repo":"passbolt/passbolt_api","slug":"it-is-not-possible-to-create-an-authentication-token-for-50e414","errorCode":null,"errorMessage":"It is not possible to create an authentication token for this user.","messagePattern":"It is not possible to create an authentication token for this user\\.","errorType":"validation","errorClass":"ValidationException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Model/Table/SsoAuthenticationTokensTable.php","lineNumber":98,"sourceCode":"     * Build the SSO authentication token\n     *\n     * @param string $userId uuid\n     * @param string $type AuthenticationToken::TYPE_*\n     * @param ?string $token token value (optional)\n     * @param ?array $data data value (optional)\n     * @throws \\App\\Error\\Exception\\ValidationException is the user is not valid\n     * @return \\App\\Model\\Entity\\AuthenticationToken $token\n     */\n    public function generate(\n        string $userId,\n        string $type,\n        ?string $token = null,\n        ?array $data = []\n    ): AuthenticationToken {\n        // TODO SsoAuthenticationTokenDataForm\n        $msg = __('It is not possible to create an authentication token for this user.');\n        if (!isset($data[SsoAuthenticationToken::DATA_IP]) || !isset($data[SsoAuthenticationToken::DATA_USER_AGENT])) {\n            throw new ValidationException($msg);\n        }\n        if (\n            !is_string($data[SsoAuthenticationToken::DATA_IP]) ||\n            !is_string($data[SsoAuthenticationToken::DATA_USER_AGENT])\n        ) {\n            throw new ValidationException($msg);\n        }\n        if (!Validation::ip($data[SsoAuthenticationToken::DATA_IP])) {\n            throw new ValidationException($msg);\n        }\n        if (!UserAgentValidation::isValid($data[SsoAuthenticationToken::DATA_USER_AGENT])) {\n            throw new ValidationException($msg);\n        }\n        if (\n            !isset($data[SsoAuthenticationToken::DATA_SSO_SETTING_ID])\n            || !is_string($data[SsoAuthenticationToken::DATA_SSO_SETTING_ID])\n            || !Validation::uuid($data[SsoAuthenticationToken::DATA_SSO_SETTING_ID])\n        ) {","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Model/Table/SsoAuthenticationTokensTable.php#L80-L116","documentation":"generate() validates the $data array before creating an SSO authentication token; the first check requires both the ip and user agent data keys to be present, otherwise a ValidationException is thrown with this message. The message is deliberately generic to avoid leaking validation details.","triggerScenarios":"Calling SsoAuthenticationTokensTable::generate() with $data missing SsoAuthenticationToken::DATA_IP or SsoAuthenticationToken::DATA_USER_AGENT keys, e.g. building the data array from a request where client IP or User-Agent header is absent.","commonSituations":"Requests proxied without X-Forwarded-For so server sees no IP; CLI commands or queue jobs that have no PSR request context; custom integrations calling the table directly without gathering request metadata.","solutions":["Ensure both keys are set in $data: [$data[SsoAuthenticationToken::DATA_IP], $data[SsoAuthenticationToken::DATA_USER_AGENT]] populated from $request->clientIp() and $request->getHeaderLine('User-Agent')","If behind a reverse proxy, configure CakePHP RequestHandler/proxy trusted proxies so client IP is detected","Reject/handle requests lacking a User-Agent header before invoking generate()"],"exampleFix":"// before\n$token = $this->SsoAuthenticationTokens->generate($type, $userId);\n// after\n$data = [\n    SsoAuthenticationToken::DATA_IP => $request->clientIp(),\n    SsoAuthenticationToken::DATA_USER_AGENT => $request->getHeaderLine('User-Agent'),\n];\n$token = $this->SsoAuthenticationTokens->generate($type, $userId, null, $data);","handlingStrategy":"validation","validationCode":"$data = [\n    SsoAuthenticationToken::DATA_IP => $request->clientIp(),\n    SsoAuthenticationToken::DATA_USER_AGENT => $request->getHeaderLine('User-Agent'),\n];\nif (!isset($data[SsoAuthenticationToken::DATA_IP], $data[SsoAuthenticationToken::DATA_USER_AGENT])) {\n    throw new \\InvalidArgumentException('IP and User-Agent required');\n}","typeGuard":"function hasTokenData(array $data): bool {\n    return isset($data[SsoAuthenticationToken::DATA_IP], $data[SsoAuthenticationToken::DATA_USER_AGENT]);\n}","tryCatchPattern":"try {\n    $token = $table->generate($type, $userId, null, $data);\n} catch (ValidationException $e) {\n    // inspect $data for missing keys\n}","preventionTips":["Always build token data from the incoming request object","Configure trusted proxies so client IP resolves","Never call generate() from CLI context without supplying request metadata"],"tags":["validation","sso","authentication-token"],"backgroundTag":"empty-required-field","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}