{"record":{"id":"75d8a10f8b3b5ad9","repo":"passbolt/passbolt_api","slug":"data-error-dynamic-provider-error-pingoneprovider","errorCode":null,"errorMessage":"$data['error'] (dynamic provider error)","messagePattern":"\\$data\\['error'\\] \\(dynamic provider error\\)","errorType":"exception","errorClass":"PingOneException","httpStatus":null,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/PingOne/Provider/PingOneProvider.php","lineNumber":85,"sourceCode":"     */\n    public function getOpenIdBaseUri(): string\n    {\n        return parent::getOpenIdBaseUri() . '/' . $this->environmentId . '/as';\n    }\n\n    /**\n     * {@inheritDoc}\n     *\n     * @throws \\Passbolt\\Sso\\Error\\Exception\\PingOneException When error and error description is present\n     * @throws \\League\\OAuth2\\Client\\Provider\\Exception\\IdentityProviderException When unknown error faced\n     */\n    protected function checkResponse(ResponseInterface $response, $data): void\n    {\n        try {\n            parent::checkResponse($response, $data);\n        } catch (OAuth2Exception $e) {\n            // Map OAuth2 exception with PingOne exception\n            throw new PingOneException($data['error'], $data['error_description']);\n        }\n    }\n\n    /**\n     * PingOne's JWKS endpoint does not include the \"alg\" parameter in JWK entries.\n     *  This override defaults to RS256 (PingOne's standard signing algorithm) when\n     *  no global defaultAlg configuration is set.\n     *\n     * @retrun mixed\n     */\n    protected function getJwksDefaultAlg(): mixed\n    {\n        return Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg') ?? 'RS256';\n    }\n\n    /**\n     * @inheritDoc\n     */","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/PingOne/Provider/PingOneProvider.php#L67-L103","documentation":"checkResponse() validates OAuth2 responses from PingOne and re-maps any OAuth2Exception raised by the parent abstract provider into a PingOneException. The message is taken dynamically from the OAuth2 error code returned by PingOne ($data['error']), with $data['error_description'] as detail. This keeps PingOne-specific error surfacing consistent while preserving the upstream error meaning.","triggerScenarios":"Any OAuth2 token-exchange or authorization response from PingOne carrying an error payload (e.g. error=invalid_grant, invalid_client, access_denied) passed through checkResponse during SSO authentication.","commonSituations":"Wrong client secret or client ID configured for the PingOne environment; user denied consent; expired/used authorization code; PingOne environment ID misconfigured; PingOne returning an HTML/JSON error page on outage.","solutions":["Check the SSO settings stored in passbolt (client id, client secret, environment id) against the PingOne admin console.","Decode error_description in the exception to identify the exact OAuth2 error and fix the corresponding configuration.","Verify the PingOne application type (Worker/SPA) and redirect URI match what passbolt sends.","Confirm network connectivity and that the PingOne domain/region endpoint is correct.","Retry SSO after fixing configuration; if intermittent, check PingOne service status."],"exampleFix":"// before (generic handling)\ncatch (OAuth2Exception $e) { /* lost */ }\n// after (surfaced by provider)\nthrow new PingOneException($data['error'], $data['error_description']);","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"try { $provider->checkResponse($response, $data); } catch (PingOneException $e) { $this->log($e->getMessage() . ': ' . $e->getPrevious()?->getMessage()); return $this->renderSsoError($e->getMessage()); }","preventionTips":["Validate client id/secret and environment id in SSO settings before enabling","Test the SSO flow with the provider's test endpoint after each config change","Log error_description to pinpoint the OAuth2 error","Keep PingOne app redirect URIs in sync with passbolt"],"tags":["oauth2","sso","pingone","error-mapping"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}