passbolt/passbolt_api · error · ValidationException

It is not possible to create an authentication token for…

Error message

It is not possible to create an authentication token for this user.

What it means

generate() validates the $data array before creating an SSO authentication token; the first check requires both the ip and user agent data keys to be present, otherwise a ValidationException is thrown with this message. The message is deliberately generic to avoid leaking validation details.

Solutions

1. Ensure both keys are set in $data: [$data[SsoAuthenticationToken::DATA_IP], $data[SsoAuthenticationToken::DATA_USER_AGENT]] populated from $request->clientIp() and $request->getHeaderLine('User-Agent')
2. If behind a reverse proxy, configure CakePHP RequestHandler/proxy trusted proxies so client IP is detected
3. Reject/handle requests lacking a User-Agent header before invoking generate()

Example fix

// before
$token = $this->SsoAuthenticationTokens->generate($type, $userId);
// after
$data = [
    SsoAuthenticationToken::DATA_IP => $request->clientIp(),
    SsoAuthenticationToken::DATA_USER_AGENT => $request->getHeaderLine('User-Agent'),
];
$token = $this->SsoAuthenticationTokens->generate($type, $userId, null, $data);

$data = [
    SsoAuthenticationToken::DATA_IP => $request->clientIp(),
    SsoAuthenticationToken::DATA_USER_AGENT => $request->getHeaderLine('User-Agent'),
];
if (!isset($data[SsoAuthenticationToken::DATA_IP], $data[SsoAuthenticationToken::DATA_USER_AGENT])) {
    throw new \InvalidArgumentException('IP and User-Agent required');
}

function hasTokenData(array $data): bool {
    return isset($data[SsoAuthenticationToken::DATA_IP], $data[SsoAuthenticationToken::DATA_USER_AGENT]);
}

try {
    $token = $table->generate($type, $userId, null, $data);
} catch (ValidationException $e) {
    // inspect $data for missing keys
}

When it happens

Trigger: Calling SsoAuthenticationTokensTable::generate() with $data missing SsoAuthenticationToken::DATA_IP or SsoAuthenticationToken::DATA_USER_AGENT keys, e.g. building the data array from a request where client IP or User-Agent header is absent.

Common situations: Requests proxied without X-Forwarded-For so server sees no IP; CLI commands or queue jobs that have no PSR request context; custom integrations calling the table directly without gathering request metadata.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The authentication token should be a valid UUID.
• Could not save the SSO state, invalid nonce.
• Could not validate the SSO recover request.
• Invalid status.
• It is not possible to create an authentication token for…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/50e4148c2938d098. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Model/Table/SsoAuthenticationTokensTable.php:98

     * Build the SSO authentication token
     *
     * @param string $userId uuid
     * @param string $type AuthenticationToken::TYPE_*
     * @param ?string $token token value (optional)
     * @param ?array $data data value (optional)
     * @throws \App\Error\Exception\ValidationException is the user is not valid
     * @return \App\Model\Entity\AuthenticationToken $token
     */
    public function generate(
        string $userId,
        string $type,
        ?string $token = null,
        ?array $data = []
    ): AuthenticationToken {
        // TODO SsoAuthenticationTokenDataForm
        $msg = __('It is not possible to create an authentication token for this user.');
        if (!isset($data[SsoAuthenticationToken::DATA_IP]) || !isset($data[SsoAuthenticationToken::DATA_USER_AGENT])) {
            throw new ValidationException($msg);
        }
        if (
            !is_string($data[SsoAuthenticationToken::DATA_IP]) ||
            !is_string($data[SsoAuthenticationToken::DATA_USER_AGENT])
        ) {
            throw new ValidationException($msg);
        }
        if (!Validation::ip($data[SsoAuthenticationToken::DATA_IP])) {
            throw new ValidationException($msg);
        }
        if (!UserAgentValidation::isValid($data[SsoAuthenticationToken::DATA_USER_AGENT])) {
            throw new ValidationException($msg);
        }
        if (
            !isset($data[SsoAuthenticationToken::DATA_SSO_SETTING_ID])
            || !is_string($data[SsoAuthenticationToken::DATA_SSO_SETTING_ID])
            || !Validation::uuid($data[SsoAuthenticationToken::DATA_SSO_SETTING_ID])
        ) {

View on GitHub (pinned to 31c1bbc10f)