{"record":{"id":"864e7bf9752e81ac","repo":"passbolt/passbolt_api","slug":"invalid-response-invalid-authorization-endpoint","errorCode":null,"errorMessage":"Invalid response. Invalid authorization endpoint.","messagePattern":"Invalid response\\. Invalid authorization endpoint\\.","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php","lineNumber":187,"sourceCode":"                // Escape newlines and control characters via JSON encoding so they don't corrupt log output.\n                $msg .= ' ' . sprintf('Response text (truncated): %s', json_encode($excerpt));\n            }\n            throw new InternalErrorException($msg);\n        }\n        if (!isset($response['jwks_uri'])) {\n            throw new InternalErrorException('Invalid response. Missing JWKS URI');\n        }\n        if (!isset($response['authorization_endpoint'])) {\n            throw new InternalErrorException('Invalid response. Missing authorization endpoint.');\n        }\n        if (!isset($response['token_endpoint'])) {\n            throw new InternalErrorException('Invalid response. Missing token endpoint.');\n        }\n        if (!Validation::url($response['jwks_uri'])) {\n            throw new InternalErrorException('Invalid response. Invalid JWKS URI');\n        }\n        if (!Validation::url($response['authorization_endpoint'])) {\n            throw new InternalErrorException('Invalid response. Invalid authorization endpoint.');\n        }\n        if (!Validation::url($response['token_endpoint'])) {\n            throw new InternalErrorException('Invalid response. Invalid token endpoint.');\n        }\n    }\n\n    /**\n     * @inheritDoc\n     */\n    protected function getAuthorizationParameters(array $options)\n    {\n        $options = parent::getAuthorizationParameters($options);\n\n        /**\n         * The \"approval_prompt\" MUST be removed as it is not supported by Google, use \"prompt\" instead:\n         *\n         * @link https://developers.google.com/identity/protocols/oauth2/openid-connect#prompt\n         */","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php#L169-L205","documentation":"validateOpenIdConfiguration() checks authorization_endpoint with Validation::url(). If the key exists but its value is not a valid absolute URL, passbolt cannot build the SSO redirect, so it throws this InternalErrorException.","triggerScenarios":"Decoded discovery JSON contains authorization_endpoint but the value fails Validation::url() (relative path, missing scheme, malformed characters).","commonSituations":"Non-compliant IdP metadata with relative endpoints; corrupted metadata from a rewriting proxy; typos in self-hosted IdP configuration (e.g. 'http:auth/authorize').","solutions":["Inspect the discovery JSON and confirm authorization_endpoint is an absolute http(s) URL.","Fix the IdP's published metadata or its endpoint base-URL configuration.","Remove/fix proxy rules that rewrite endpoint URLs in the discovery document.","Re-test SSO after the IdP publishes a valid URL."],"exampleFix":"// before\n'{\"authorization_endpoint\":\"auth/authorize\"}'\n// after\n'{\"authorization_endpoint\":\"https://auth.example.com/authorize\"}'","handlingStrategy":"validation","validationCode":"use Cake\\Validation\\Validation;\n$doc = json_decode(file_get_contents($wellKnownUrl), true);\nif (!isset($doc['authorization_endpoint']) || !Validation::url($doc['authorization_endpoint'])) { throw new UnexpectedValueException('authorization_endpoint missing or not a valid absolute URL.'); }","typeGuard":"function isValidAuthorizationEndpoint(mixed $doc): bool { return is_array($doc) && isset($doc['authorization_endpoint']) && is_string($doc['authorization_endpoint']) && Validation::url($doc['authorization_endpoint']); }","tryCatchPattern":"try { $authUrl = $provider->getBaseAuthorizationUrl(); } catch (InternalErrorException $e) { if (str_contains($e->getMessage(), 'Invalid authorization endpoint')) { /* metadata emits malformed authorization_endpoint */ } throw $e; }","preventionTips":["Configure the IdP with a correct external base URL so it emits absolute endpoints","Diff discovery output against a known-good snapshot after upgrades","Exclude the metadata endpoint from URL-rewriting proxies","Validate endpoint URLs in an automated pre-SSO check"],"tags":["openid-configuration","url-validation","oidc","response-validation"],"backgroundTag":"invalid-url-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}