passbolt/passbolt_api · error · InternalErrorException

$exception->getMessage() (dynamic wrapped error)

Error message

$exception->getMessage() (dynamic wrapped error)

What it means

getOpenIdConfiguration() fetches the IdP's .well-known/openid-configuration document. OAuth2/IdentityProvider exceptions are re-thrown as-is, but any other Exception (network error, HTTP client error, invalid URL, etc.) is wrapped into an InternalErrorException whose message is the original exception's message. This distinguishes OAuth protocol errors from transport/parsing failures.

Solutions

1. Read the wrapped message: it names the underlying cause (DNS, timeout, TLS) and fix that.
2. Verify the issuer / WellKnownURI configured in passbolt matches the IdP exactly.
3. Confirm the server can reach the IdP discovery endpoint (curl the .well-known URL from the passbolt host).
4. Check proxy/TLS settings; retry SSO after restoring connectivity.

Example fix

// before
catch (Exception $exception) {
    throw new InternalErrorException($exception->getMessage(), 500, $exception);
}
// after (same wrap; fix the underlying cause shown in the message)
// e.g. correct issuer URL: https://auth.example.com/.well-known/openid-configuration

$wellKnown = rtrim($issuer, '/') . '/.well-known/openid-configuration';
$ch = curl_init($wellKnown); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_TIMEOUT, 5);
$body = curl_exec($ch); if ($body === false || curl_getinfo($ch, CURLINFO_HTTP_CODE) !== 200) { /* IdP unreachable: fix network/issuer before calling SSO */ }

null

try { $config = $provider->getOpenIdConfiguration(); } catch (InternalErrorException $e) { $this->log('OIDC discovery failed: ' . $e->getMessage()); throw new InternalErrorException('SSO provider unreachable, check issuer URL and network.'); } catch (OAuth2Exception $e) { /* protocol-level error */ }

When it happens

Trigger: Called by getJwtVerificationKeys, getBaseAuthorizationUrl and getBaseAccessTokenUrl on first SSO use; throws when Guzzle/HTTP layer fails (DNS failure, TLS error, timeout, malformed provider configuration URL) or the response cannot be parsed.

Common situations: Wrong issuer/WellKnownURI in passbolt SSO settings; IdP unreachable behind firewall/proxy; DNS misconfiguration; SSL certificate issues; HTTP 5xx from IdP raising a non-OAuth exception.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• Cannot parse JWKS endpoint response.
• Invalid response. Expected array, got
• AccessToken should be an instance of BaseIdToken class.
• Ajax/Json request not supported.
• Ajax/Json request not supported.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/eaf7edbd8d60f6fd. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php:147

    protected function getOpenIdConfiguration(): array
    {
        if (isset($this->openIdConfiguration)) {
            return $this->openIdConfiguration;
        }

        $factory = $this->getRequestFactory();
        $request = $factory->getRequestWithOptions(
            'get',
            $this->getOpenIdConfigurationUri(),
            []
        );

        try {
            $response = $this->getParsedResponse($request);
        } catch (OAuth2Exception | IdentityProviderException $exception) {
            throw $exception;
        } catch (Exception $exception) {
            throw new InternalErrorException($exception->getMessage(), 500, $exception);
        }

        $this->validateOpenIdConfiguration($response);
        $this->openIdConfiguration = $response;

        return $this->openIdConfiguration;
    }

    /**
     * Check the endpoints info we expect to use later are present
     *
     * @param mixed $response from .well-known
     * @return void
     */
    public function validateOpenIdConfiguration(mixed $response): void
    {
        if (!is_array($response)) {
            $msg = sprintf('Invalid response. Expected array, got "%s".', gettype($response));

View on GitHub (pinned to 31c1bbc10f)