{"record":{"id":"d816d13672c70012","repo":"passbolt/passbolt_api","slug":"the-permission-of-secretkeypath-could-not-be-set-to","errorCode":null,"errorMessage":"The permission of $secretKeyPath could not be set to $permission.","messagePattern":"The permission of \\$secretKeyPath could not be set to \\$permission\\.","errorType":"http","errorClass":"InvalidJwtKeyPairException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltCe/JwtAuthentication/src/Service/AccessToken/JwtKeyPairService.php","lineNumber":92,"sourceCode":"                throw new Exception('The JWT private key could not be created.');\n            }\n            $export = openssl_pkey_export_to_file($pk, $secretKeyPath);\n            if ($export === false) {\n                throw new Exception('The JWT private key could not be written.');\n            }\n            $publicKey = openssl_pkey_get_details($pk)['key'] ?? false;\n            if ($publicKey === false) {\n                throw new Exception('The JWT public key could not be extracted.');\n            }\n            $export = file_put_contents($publicKeyPath, $publicKey);\n            if ($export === false) {\n                throw new Exception('The JWT public key could not be written.');\n            }\n\n            $permission = 0640;\n            $res = chmod($secretKeyPath, $permission);\n            if (!$res) {\n                throw new Exception(\"The permission of $secretKeyPath could not be set to $permission.\");\n            }\n            $res = chmod($publicKeyPath, $permission);\n            if (!$res) {\n                throw new Exception(\"The permission of $publicKeyPath could not be set to $permission.\");\n            }\n        } catch (Throwable $e) {\n            throw new InvalidJwtKeyPairException($e->getMessage());\n        }\n    }\n\n    /**\n     * Validate the key pair validity as defined by the public and secret services.\n     *\n     * @param string|null $uuid Uuid for testing aim\n     * @return object\n     * @throws \\Passbolt\\JwtAuthentication\\Error\\Exception\\AccessToken\\InvalidJwtKeyPairException\n     */\n    public function validateKeyPair(?string $uuid = null): object","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/JwtAuthentication/src/Service/AccessToken/JwtKeyPairService.php#L74-L110","documentation":"After writing both key files, createKeyPair() chmods the private key to 0640. If chmod() fails, this interpolated error names the failing secret key path and the intended permission, then is rethrown as InvalidJwtKeyPairException.","triggerScenarios":"chmod($secretKeyPath, 0640) returns false — the file is owned by another user (root created it, web server cannot chmod), the filesystem does not support chmod (some NFS/Samba mounts, Windows), or safe-mode/open_basedir restrictions apply.","commonSituations":"Running the JWT command with sudo then serving passbolt as www-data; NFS mounts with root_squash; containers running as a different UID than the key file owner.","solutions":["Run the key generation as the same user that owns config/jwt (e.g. su -s /bin/bash -c '...' www-data) or chown the files afterwards: chown www-data:www-data config/jwt/*","Set the permissions manually: chmod 640 config/jwt/jwt.private.key config/jwt/jwt.public.key, then re-run validation only","Check whether the filesystem supports chmod; on unsupported mounts pre-set permissions at mount/build time","Verify open_basedir/safe-mode settings in php.ini are not restricting the path"],"exampleFix":"// before\nsudo bin/cake passbolt create jwt_keys   # files owned by root\n// after\nsudo -u www-data bin/cake passbolt create jwt_keys\nsudo chmod 640 config/jwt/jwt.*.key","handlingStrategy":"try-catch","validationCode":"clearstatcache();\nif (fileowner($secretKeyPath) !== posix_getuid()) { /* regenerate as owning user or pre-chmod */ }","typeGuard":null,"tryCatchPattern":"try { $service->createKeyPair(); } catch (InvalidJwtKeyPairException $e) { exec('chmod 640 ' . escapeshellarg($secretKeyPath)); }","preventionTips":["Run key generation as the web server user (sudo -u www-data)","Avoid root-created key files without follow-up chown","Verify chmod support on the target filesystem (not NFS with root_squash)"],"tags":["jwt","permissions","chmod","file"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}