{"record":{"id":"eaf7edbd8d60f6fd","repo":"passbolt/passbolt_api","slug":"exception-getmessage-dynamic-wrapped-error","errorCode":null,"errorMessage":"$exception->getMessage() (dynamic wrapped error)","messagePattern":"\\$exception->getMessage\\(\\) \\(dynamic wrapped error\\)","errorType":"exception","errorClass":"InternalErrorException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php","lineNumber":147,"sourceCode":"    protected function getOpenIdConfiguration(): array\n    {\n        if (isset($this->openIdConfiguration)) {\n            return $this->openIdConfiguration;\n        }\n\n        $factory = $this->getRequestFactory();\n        $request = $factory->getRequestWithOptions(\n            'get',\n            $this->getOpenIdConfigurationUri(),\n            []\n        );\n\n        try {\n            $response = $this->getParsedResponse($request);\n        } catch (OAuth2Exception | IdentityProviderException $exception) {\n            throw $exception;\n        } catch (Exception $exception) {\n            throw new InternalErrorException($exception->getMessage(), 500, $exception);\n        }\n\n        $this->validateOpenIdConfiguration($response);\n        $this->openIdConfiguration = $response;\n\n        return $this->openIdConfiguration;\n    }\n\n    /**\n     * Check the endpoints info we expect to use later are present\n     *\n     * @param mixed $response from .well-known\n     * @return void\n     */\n    public function validateOpenIdConfiguration(mixed $response): void\n    {\n        if (!is_array($response)) {\n            $msg = sprintf('Invalid response. Expected array, got \"%s\".', gettype($response));","sourceCodeStart":129,"sourceCodeEnd":165,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php#L129-L165","documentation":"getOpenIdConfiguration() fetches the IdP's .well-known/openid-configuration document. OAuth2/IdentityProvider exceptions are re-thrown as-is, but any other Exception (network error, HTTP client error, invalid URL, etc.) is wrapped into an InternalErrorException whose message is the original exception's message. This distinguishes OAuth protocol errors from transport/parsing failures.","triggerScenarios":"Called by getJwtVerificationKeys, getBaseAuthorizationUrl and getBaseAccessTokenUrl on first SSO use; throws when Guzzle/HTTP layer fails (DNS failure, TLS error, timeout, malformed provider configuration URL) or the response cannot be parsed.","commonSituations":"Wrong issuer/WellKnownURI in passbolt SSO settings; IdP unreachable behind firewall/proxy; DNS misconfiguration; SSL certificate issues; HTTP 5xx from IdP raising a non-OAuth exception.","solutions":["Read the wrapped message: it names the underlying cause (DNS, timeout, TLS) and fix that.","Verify the issuer / WellKnownURI configured in passbolt matches the IdP exactly.","Confirm the server can reach the IdP discovery endpoint (curl the .well-known URL from the passbolt host).","Check proxy/TLS settings; retry SSO after restoring connectivity."],"exampleFix":"// before\ncatch (Exception $exception) {\n    throw new InternalErrorException($exception->getMessage(), 500, $exception);\n}\n// after (same wrap; fix the underlying cause shown in the message)\n// e.g. correct issuer URL: https://auth.example.com/.well-known/openid-configuration","handlingStrategy":"try-catch","validationCode":"$wellKnown = rtrim($issuer, '/') . '/.well-known/openid-configuration';\n$ch = curl_init($wellKnown); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_TIMEOUT, 5);\n$body = curl_exec($ch); if ($body === false || curl_getinfo($ch, CURLINFO_HTTP_CODE) !== 200) { /* IdP unreachable: fix network/issuer before calling SSO */ }","typeGuard":"null","tryCatchPattern":"try { $config = $provider->getOpenIdConfiguration(); } catch (InternalErrorException $e) { $this->log('OIDC discovery failed: ' . $e->getMessage()); throw new InternalErrorException('SSO provider unreachable, check issuer URL and network.'); } catch (OAuth2Exception $e) { /* protocol-level error */ }","preventionTips":["Curl the .well-known URL from the passbolt host before enabling SSO","Match the issuer string exactly (scheme, host, path, trailing slash)","Check DNS/TLS/proxy on the server, not just your workstation","Monitor IdP uptime; handle 5xx responses gracefully"],"tags":["oauth2","openid-configuration","http","network"],"backgroundTag":"http-request-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}