passbolt/passbolt_api · error · PingOneException

$data['error'] (dynamic provider error)

Error message

$data['error'] (dynamic provider error)

What it means

checkResponse() validates OAuth2 responses from PingOne and re-maps any OAuth2Exception raised by the parent abstract provider into a PingOneException. The message is taken dynamically from the OAuth2 error code returned by PingOne ($data['error']), with $data['error_description'] as detail. This keeps PingOne-specific error surfacing consistent while preserving the upstream error meaning.

Solutions

1. Check the SSO settings stored in passbolt (client id, client secret, environment id) against the PingOne admin console.
2. Decode error_description in the exception to identify the exact OAuth2 error and fix the corresponding configuration.
3. Verify the PingOne application type (Worker/SPA) and redirect URI match what passbolt sends.
4. Confirm network connectivity and that the PingOne domain/region endpoint is correct.
5. Retry SSO after fixing configuration; if intermittent, check PingOne service status.

Example fix

// before (generic handling)
catch (OAuth2Exception $e) { /* lost */ }
// after (surfaced by provider)
throw new PingOneException($data['error'], $data['error_description']);

null

null

try { $provider->checkResponse($response, $data); } catch (PingOneException $e) { $this->log($e->getMessage() . ': ' . $e->getPrevious()?->getMessage()); return $this->renderSsoError($e->getMessage()); }

When it happens

Trigger: Any OAuth2 token-exchange or authorization response from PingOne carrying an error payload (e.g. error=invalid_grant, invalid_client, access_denied) passed through checkResponse during SSO authentication.

Common situations: Wrong client secret or client ID configured for the PingOne environment; user denied consent; expired/used authorization code; PingOne environment ID misconfigured; PingOne returning an HTML/JSON error page on outage.

Related errors

• AccessToken should be an instance of BaseIdToken class.
• Cannot parse JWKS endpoint response.
• $data['error'] (dynamic provider error)
• $data['error'] (dynamic provider error)
• $e->getMessage() from OAuth2Exception during admin SSO…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/75d8a10f8b3b5ad9. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/PingOne/Provider/PingOneProvider.php:85

     */
    public function getOpenIdBaseUri(): string
    {
        return parent::getOpenIdBaseUri() . '/' . $this->environmentId . '/as';
    }

    /**
     * {@inheritDoc}
     *
     * @throws \Passbolt\Sso\Error\Exception\PingOneException When error and error description is present
     * @throws \League\OAuth2\Client\Provider\Exception\IdentityProviderException When unknown error faced
     */
    protected function checkResponse(ResponseInterface $response, $data): void
    {
        try {
            parent::checkResponse($response, $data);
        } catch (OAuth2Exception $e) {
            // Map OAuth2 exception with PingOne exception
            throw new PingOneException($data['error'], $data['error_description']);
        }
    }

    /**
     * PingOne's JWKS endpoint does not include the "alg" parameter in JWK entries.
     *  This override defaults to RS256 (PingOne's standard signing algorithm) when
     *  no global defaultAlg configuration is set.
     *
     * @retrun mixed
     */
    protected function getJwksDefaultAlg(): mixed
    {
        return Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg') ?? 'RS256';
    }

    /**
     * @inheritDoc
     */

View on GitHub (pinned to 31c1bbc10f)