{"record":{"id":"a0302d4280dbf77d","repo":"passbolt/passbolt_api","slug":"no-jwt-key-defined-for-azure-service","errorCode":null,"errorMessage":"No JWT key defined for Azure service.","messagePattern":"No JWT key defined for Azure service\\.","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Azure/Provider/AzureProvider.php","lineNumber":230,"sourceCode":"                        throw new InternalErrorException($msg);\n                    }\n\n                    $pkey_array = openssl_pkey_get_details($pkey_object);\n\n                    if ($pkey_array === false) {\n                        $msg = __('Failed to public key properties from certificate: {0}', $encodedkey);\n                        throw new InternalErrorException($msg);\n                    }\n\n                    $publicKey = $pkey_array['key'];\n\n                    $keys[$keyinfo['kid']] = new Key($publicKey, 'RS256');\n                }\n            }\n        }\n\n        if (empty($keys)) {\n            throw new InternalErrorException('No JWT key defined for Azure service.');\n        }\n\n        return $keys;\n    }\n}\n","sourceCodeStart":212,"sourceCodeEnd":236,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Azure/Provider/AzureProvider.php#L212-L236","documentation":"Thrown by AzureProvider::parseJwksKeys after iterating all JWKS key entries when no verification key could be built ($keys is empty). Every key entry lacked a usable 'x5c' array (or the x5c loop produced nothing), so there is no key to verify Azure-issued JWTs and SSO cannot proceed.","triggerScenarios":"The JWKS response contains key entries without an 'x5c' member (or with a non-array x5c), or 'keys' is an empty array — the code silently skips entries without x5c and only fails at the end with this message.","commonSituations":"Azure AD rotating keys or serving EC-only keys without x5c in a non-standard endpoint; a custom/alternative JWKS source (e.g. a different IdP routed through this provider) whose keys lack x5c; mock fixtures missing x5c; Azure outage returning a minimal key set.","solutions":["Inspect the JWKS response (curl the jwks_uri) and confirm key entries include an 'x5c' array with base64 DER certificates.","Ensure the OpenID configuration points at the correct Azure AD tenant/common discovery document whose jwks_uri serves x5c-bearing RSA keys.","If keys were recently rotated, clear any cached OpenID configuration and re-fetch the JWKS.","If you control the JWKS source (test fixture/custom IdP), add x5c certificate values to each RSA key entry."],"exampleFix":"null","handlingStrategy":"validation","validationCode":"$jwks = json_decode(file_get_contents($jwksUri), true);\n$usable = array_filter($jwks['keys'] ?? [], fn($k) => isset($k['x5c']) && is_array($k['x5c']) && $k['x5c'] !== []);\nif ($usable === []) {\n    throw new RuntimeException('JWKS contains no x5c-bearing keys; JWT verification will fail');\n}","typeGuard":"function jwksHasVerifiableKeys(array $keys): bool {\n    foreach ($keys as $key) {\n        if (isset($key['x5c']) && is_array($key['x5c']) && $key['x5c'] !== []) {\n            return true;\n        }\n    }\n    return false;\n}","tryCatchPattern":"try {\n    $keys = $provider->getJwtVerificationKeys();\n} catch (InternalErrorException $e) {\n    if ($e->getMessage() === 'No JWT key defined for Azure service.') {\n        Log::error('JWKS yielded zero usable keys — check x5c presence and tenant configuration');\n    }\n    throw $e;\n}","preventionTips":["Verify the discovery document targets the correct Azure AD tenant so jwks_uri serves x5c RSA keys","Periodically fetch and validate the JWKS (non-empty keys with x5c) as a health check","Clear cached OpenID configuration after Azure key rotations","Ensure custom/mock JWKS fixtures include x5c arrays for every key"],"tags":["sso","azure","jwks","jwt","empty-result"],"backgroundTag":"empty-result-set","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}