{"record":{"id":"d7a8033dd6ca5243","repo":"passbolt/passbolt_api","slug":"the-ver-version-parameter-is-invalid","errorCode":null,"errorMessage":"The ver (version) parameter is invalid.","messagePattern":"The ver \\(version\\) parameter is invalid\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"warning","filePath":"plugins/PassboltEe/Sso/src/Utility/Azure/OpenId/AzureIdToken.php","lineNumber":58,"sourceCode":"     *\n     * Override this method to perform provider specific assertions.\n     */\n    public function assertTokenClaims(array $tokenClaims): void\n    {\n        parent::assertTokenClaims($tokenClaims);\n\n        if (\n            !isset($tokenClaims['tid']) || !is_string($tokenClaims['tid']) ||\n            $this->provider->getTenant() != $tokenClaims['tid']\n        ) {\n            throw new BadRequestException('The tid (tenant id) parameter is invalid.');\n        }\n\n        if (\n            !isset($tokenClaims['ver']) || !is_string($tokenClaims['ver']) ||\n            $tokenClaims['ver'] != AzureProvider::ENDPOINT_VERSION_2_0\n        ) {\n            throw new BadRequestException('The ver (version) parameter is invalid.');\n        }\n    }\n}\n","sourceCodeStart":40,"sourceCodeEnd":62,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Azure/OpenId/AzureIdToken.php#L40-L62","documentation":"AzureIdToken::assertTokenClaims() enforces that the ID token 'ver' claim is the string '2.0' (AzureProvider::ENDPOINT_VERSION_2_0). Tokens from the Azure AD v1 endpoint (ver=1.0) are rejected because the plugin only supports the v2.0 endpoint.","triggerScenarios":"A v1.0 ID token is submitted — either the OpenID configuration URL used is the v1 one, or the Azure app was created/registered against the legacy endpoint.","commonSituations":"Well-known config pointing to login.microsoftonline.com/{tenant}/.well-known/openid-configuration instead of the v2.0 variant; Azure app registered as legacy; a proxy or cached discovery document serving v1 metadata; custom token issuance defaulting to v1.","solutions":["Point the OpenID configuration / discovery URL to the v2.0 endpoint ( .../v2.0/.well-known/openid-configuration )","Re-register or update the Azure app to use the v2.0 endpoint","Re-run the SSO setup so passbolt caches the v2.0 metadata","Decode the received token to confirm the ver value and issue it again after endpoint correction"],"exampleFix":"// before (v1 discovery)\n$openIdConfig = 'https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration';\n// after (v2.0)\n$openIdConfig = 'https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration';","handlingStrategy":"try-catch","validationCode":"$claims = json_decode(base64_decode(strtr(explode('.', $idToken)[1], '-_', '+/')), true); if (($claims['ver'] ?? null) !== '2.0') { /* v1 token, fix discovery URL */ }","typeGuard":"function isV2Token(?string $ver): bool { return $ver === '2.0'; }","tryCatchPattern":"try { AzureIdToken::assertTokenClaims($claims); } catch (BadRequestException $e) { Log::error('Non-v2.0 Azure ID token: check openid-config URL'); throw $e; }","preventionTips":["Always use the v2.0 well-known/openid-configuration URL","Re-register Azure apps on the v2.0 endpoint","Re-run SSO setup after changing endpoints to refresh cached metadata"],"tags":["sso","azure-ad","jwt","endpoint-version"],"backgroundTag":"jwt-claim-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}