passbolt/passbolt_api · error · InternalErrorException

No default expiry or expiry for token type

Error message

No default expiry or expiry for token type 

What it means

SsoAuthTokenExpiry::getExpiryForTokenType() resolves the expiry duration for an SSO auth token type: first from a per-type config, then falling back to passbolt.auth.tokenExpiry. If neither yields a string, an InternalErrorException is thrown. (Note the message itself concatenates null, hence the trailing space.)

Solutions

1. Ensure passbolt.php / app.default.php defines passbolt.auth.tokenExpiry (e.g. '3 days')
2. Reload plugin config: clear cache (`bin/cake cache clear_all`) and re-deploy config files
3. Check the token type passed in matches one configured in SsoAuthTokenExpiry
4. Verify the Sso plugin's config/bootstrap.php is loaded in the application bootstrap

Example fix

// before: passbolt.php missing key
// after
Configure::write('passbolt.auth.tokenExpiry', '3 days');

if (!is_string(Configure::read('passbolt.auth.tokenExpiry'))) { throw new \RuntimeException('passbolt.auth.tokenExpiry missing in config'); }

function tokenExpiryConfigured(): bool { $v = Configure::read('passbolt.auth.tokenExpiry'); return is_string($v) && strtotime($v) !== false; }

try { $expiry = SsoAuthTokenExpiry::getExpiryForTokenType($type); } catch (InternalErrorException $e) { Log::critical('SSO tokenExpiry config missing'); throw $e; }

When it happens

Trigger: getExpiryForTokenType() called with a token type that has no Configure entry under passbolt.security.authToken.expiry (or equivalent) AND the global passbolt.auth.tokenExpiry config is not set (null/non-string).

Common situations: Running the SSO plugin without loading its default config (config/bootstrap not loaded after manual install); a typo'd token type string; config file overridden in production losing the default; PHP config cache stale.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• Provided root CA file does not exist
• Record not found in table "sso_auth_tokens"
• The configuration value should be a string or NULL.
• The configuration value should be one of the following: .
• The authentication token does not exist.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/6289a792384d472f. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/AuthToken/SsoAuthTokenExpiry.php:51

        if (!in_array($tokenType, SsoAuthenticationTokensTable::SSO_ALLOWED_TYPES)) {
            throw new InvalidArgumentException(
                sprintf(
                    'Invalid $tokenType `%s`. Must be one of `%s`.',
                    $tokenType,
                    implode(',', SsoAuthenticationTokensTable::SSO_ALLOWED_TYPES)
                )
            );
        }

        $tokenTypeExpiry = Configure::read(sprintf('passbolt.auth.token.%s.expiry', $tokenType));

        if (!is_string($tokenTypeExpiry)) {
            $tokenTypeExpiry = Configure::read('passbolt.auth.tokenExpiry');
        }

        if (!is_string($tokenTypeExpiry)) {
            $msg = 'No default expiry or expiry for token type ' . $tokenTypeExpiry;
            throw new InternalErrorException($msg);
        }

        return $tokenTypeExpiry;
    }
}

View on GitHub (pinned to 31c1bbc10f)