{"record":{"id":"769d2db338d6f435","repo":"passbolt/passbolt_api","slug":"the-iss-issuer-parameter-is-invalid","errorCode":null,"errorMessage":"The iss (issuer) parameter is invalid.","messagePattern":"The iss \\(issuer\\) parameter is invalid\\.","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/OpenId/BaseIdToken.php","lineNumber":145,"sourceCode":"        $emailClaim = Configure::read('passbolt.plugins.sso.security.oauth2.emailClaimAlias') ?? 'email';\n\n        if (!isset($tokenClaims[$emailClaim]) || !EmailValidationRule::check($tokenClaims[$emailClaim])) {\n            throw new BadRequestException('The email claim is not found or invalid.');\n        }\n    }\n\n    /**\n     * Validate issuer against provider base uri\n     * Allows for trailing slash variations\n     *\n     * @param array $tokenClaims claims\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the claim does not validate\n     */\n    public function assertIssClaim(array $tokenClaims): void\n    {\n        if (!isset($tokenClaims['iss']) || !is_string($tokenClaims['iss'])) {\n            throw new BadRequestException('The iss (issuer) parameter is invalid.');\n        }\n\n        $openIdBaseUri = rtrim($this->provider->getOpenIdBaseUri(), '/');\n        $iss = rtrim($tokenClaims['iss'], '/');\n        if ($iss !== $openIdBaseUri) {\n            throw new BadRequestException('The iss (issuer) parameter does not match.');\n        }\n    }\n\n    /**\n     * https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3\n     *\n     * @param array $tokenClaims claims\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the claim does not validate\n     */\n    public function assertAudClaim(array $tokenClaims): void\n    {","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/OpenId/BaseIdToken.php#L127-L163","documentation":"assertIssClaim first checks that the `iss` claim exists and is a string; otherwise it throws BadRequestException('The iss (issuer) parameter is invalid.'). The iss claim identifies who issued the token and is the first half of issuer validation before comparing against the provider's base URI.","triggerScenarios":"assertTokenClaims runs assertIssClaim on claims where the `iss` key is absent or not a string — a token issued without an iss claim or with a non-string (null/array) value.","commonSituations":"Custom or misbehaving providers omitting iss; tokens minted by a different service without OIDC-standard claims; corrupted token payload after manual edits.","solutions":["Inspect the decoded token payload to confirm an `iss` string claim exists (debugEnabled logging or jwt.io).","Obtain a fresh token from the correct provider endpoint — tokens missing iss were not issued by the expected OIDC flow.","Verify the provider configuration (discovery document) actually advertises and includes standard claims.","Ensure you are validating the id_token, not another token type (e.g. access token) that may omit iss."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!isset($claims['iss']) || !is_string($claims['iss'])) {\n    throw new RuntimeException('id_token missing string iss claim');\n}","typeGuard":"function hasStringIss(array $claims): bool {\n    return isset($claims['iss']) && is_string($claims['iss']) && $claims['iss'] !== '';\n}","tryCatchPattern":"try {\n    $token->assertTokenClaims($claims);\n} catch (BadRequestException $e) {\n    if (str_contains($e->getMessage(), 'iss (issuer) parameter is invalid')) { /* token lacks iss; not from expected OIDC flow */ }\n}","preventionTips":["Validate tokens only from the provider's OIDC endpoints (id_token, not access token)","Fetch the discovery document at setup to confirm standard claims are emitted","Reject tokens at ingestion if mandatory OIDC claims are absent"],"tags":["jwt","claims","issuer","openid","sso"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}