{"record":{"id":"f9d6f7be54fdb47c","repo":"passbolt/passbolt_api","slug":"single-sign-on-failed-the-0-claim-is-not-present-please-f9d6f7","errorCode":null,"errorMessage":"Single sign-on failed. The {0} claim is not present, please contact your administrator.","messagePattern":"Single sign-on failed\\. The (.+?) claim is not present, please contact your administrator\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/PingOne/ResourceOwner/PingOneResourceOwner.php","lineNumber":54,"sourceCode":"\n        $this->emailClaimField = $emailClaimField ?? SsoSetting::PINGONE_EMAIL_CLAIM_EMAIL;\n    }\n\n    /**\n     * Retrieves email of the resource owner.\n     *\n     * @return string\n     * @throws \\Cake\\Http\\Exception\\BadRequestException When email claim field is not present in the data.\n     */\n    public function getEmail(): string\n    {\n        if (!isset($this->data[$this->emailClaimField]) || is_null($this->data[$this->emailClaimField])) {\n            $msg = __('Single sign-on failed.') . ' ';\n            $msg .= __(\n                'The {0} claim is not present, please contact your administrator.',\n                $this->emailClaimField\n            );\n            throw new BadRequestException($msg);\n        }\n\n        return $this->data[$this->emailClaimField];\n    }\n}\n","sourceCodeStart":36,"sourceCodeEnd":60,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/PingOne/ResourceOwner/PingOneResourceOwner.php#L36-L60","documentation":"PingOneResourceOwner->getEmail() requires the configured email claim (default 'email') in the resource-owner payload returned by PingOne. When the claim key is absent or null it throws a BadRequestException telling the administrator which claim is missing. This happens because the PingOne application is not mapping the email attribute into the token or a custom claim name is configured that the IdP does not send.","triggerScenarios":"Decoding a PingOne ID token / calling getUser() where the resource-owner array lacks the configured emailClaimField; using a custom claim name that PingOne does not include in the token.","commonSituations":"PingOne app 'Token' mapping does not include the email attribute; passbolt SSO settings define a custom claim (e.g. 'mail') but PingOne sends 'email'; user account in PingOne has no email set.","solutions":["In the PingOne admin console, add an attribute mapping so the email claim is included in the token.","Check the claim name configured in passbolt SSO settings matches exactly what PingOne sends (case-sensitive).","Ensure the PingOne user has an email populated on their profile.","If a custom claim is intended, update emailClaimField in the passbolt settings to that key and re-test."],"exampleFix":"// before (custom claim not sent)\n'emailClaimField' => 'mail',\n// after (use claim PingOne actually sends)\n'emailClaimField' => 'email',","handlingStrategy":"validation","validationCode":"$payload = json_decode(base64_decode(str_replace('_', '/', str_replace('-', '_', explode('.', $jwt)[1]))), true);\n$claim = $settings->getClaimForEmail() ?: 'email';\nif (!isset($payload[$claim]) || $payload[$claim] === null) { throw new BadRequestException(\"SSO token is missing the {$claim} claim.\"); }","typeGuard":"function hasEmailClaim(array $data, string $field): bool { return isset($data[$field]) && is_string($data[$field]) && filter_var($data[$field], FILTER_VALIDATE_EMAIL) !== false; }","tryCatchPattern":"try { $email = $resourceOwner->getEmail(); } catch (BadRequestException $e) { $this->log($e->getMessage()); return $this->renderSsoError('Your identity provider did not send the required email attribute.'); }","preventionTips":["Add the email attribute mapping in the PingOne application token config","Keep the claim name in passbolt settings identical to what the IdP sends","Ensure every IdP user has an email populated","Write an integration test decoding a sample token with the configured claim"],"tags":["sso","pingone","oidc","missing-claim"],"backgroundTag":"unexpected-response-shape","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}