passbolt/passbolt_api · error · InternalErrorException

Invalid response. Invalid authorization endpoint.

Error message

Invalid response. Invalid authorization endpoint.

What it means

validateOpenIdConfiguration() checks authorization_endpoint with Validation::url(). If the key exists but its value is not a valid absolute URL, passbolt cannot build the SSO redirect, so it throws this InternalErrorException.

Solutions

1. Inspect the discovery JSON and confirm authorization_endpoint is an absolute http(s) URL.
2. Fix the IdP's published metadata or its endpoint base-URL configuration.
3. Remove/fix proxy rules that rewrite endpoint URLs in the discovery document.
4. Re-test SSO after the IdP publishes a valid URL.

Example fix

// before
'{"authorization_endpoint":"auth/authorize"}'
// after
'{"authorization_endpoint":"https://auth.example.com/authorize"}'

use Cake\Validation\Validation;
$doc = json_decode(file_get_contents($wellKnownUrl), true);
if (!isset($doc['authorization_endpoint']) || !Validation::url($doc['authorization_endpoint'])) { throw new UnexpectedValueException('authorization_endpoint missing or not a valid absolute URL.'); }

function isValidAuthorizationEndpoint(mixed $doc): bool { return is_array($doc) && isset($doc['authorization_endpoint']) && is_string($doc['authorization_endpoint']) && Validation::url($doc['authorization_endpoint']); }

try { $authUrl = $provider->getBaseAuthorizationUrl(); } catch (InternalErrorException $e) { if (str_contains($e->getMessage(), 'Invalid authorization endpoint')) { /* metadata emits malformed authorization_endpoint */ } throw $e; }

When it happens

Trigger: Decoded discovery JSON contains authorization_endpoint but the value fails Validation::url() (relative path, missing scheme, malformed characters).

Common situations: Non-compliant IdP metadata with relative endpoints; corrupted metadata from a rewriting proxy; typos in self-hosted IdP configuration (e.g. 'http:auth/authorize').

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• Invalid response. Invalid token endpoint.
• Invalid response. Invalid JWKS URI
• Invalid response. Missing authorization endpoint.
• Invalid response. Missing JWKS URI
• Invalid response. Missing token endpoint.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/864e7bf9752e81ac. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php:187

                // Escape newlines and control characters via JSON encoding so they don't corrupt log output.
                $msg .= ' ' . sprintf('Response text (truncated): %s', json_encode($excerpt));
            }
            throw new InternalErrorException($msg);
        }
        if (!isset($response['jwks_uri'])) {
            throw new InternalErrorException('Invalid response. Missing JWKS URI');
        }
        if (!isset($response['authorization_endpoint'])) {
            throw new InternalErrorException('Invalid response. Missing authorization endpoint.');
        }
        if (!isset($response['token_endpoint'])) {
            throw new InternalErrorException('Invalid response. Missing token endpoint.');
        }
        if (!Validation::url($response['jwks_uri'])) {
            throw new InternalErrorException('Invalid response. Invalid JWKS URI');
        }
        if (!Validation::url($response['authorization_endpoint'])) {
            throw new InternalErrorException('Invalid response. Invalid authorization endpoint.');
        }
        if (!Validation::url($response['token_endpoint'])) {
            throw new InternalErrorException('Invalid response. Invalid token endpoint.');
        }
    }

    /**
     * @inheritDoc
     */
    protected function getAuthorizationParameters(array $options)
    {
        $options = parent::getAuthorizationParameters($options);

        /**
         * The "approval_prompt" MUST be removed as it is not supported by Google, use "prompt" instead:
         *
         * @link https://developers.google.com/identity/protocols/oauth2/openid-connect#prompt
         */

View on GitHub (pinned to 31c1bbc10f)