passbolt/passbolt_api · error · IdentityProviderException

$response->getReasonPhrase() (dynamic provider error)

Error message

$response->getReasonPhrase() (dynamic provider error)

What it means

This is the fallback branch of OAuth2Provider::checkResponse: when the error response body is not in the standard `error`+`error_description` string shape, the library throws an IdentityProviderException built from the PSR-7 response's reason phrase (e.g. 'Bad Request', 'Internal Server Error'), status code, and raw body. It surfaces non-conformant or non-JSON provider error responses.

Solutions

1. Inspect the IdentityProviderException body/status to see the raw provider response and identify the true failure.
2. Check provider status pages and network path (proxies, load balancers) for intercepted or malformed responses.
3. Confirm the token endpoint URL in the SSO provider settings points at the correct, current OAuth2 endpoint.
4. Retry the flow once transient upstream outages (5xx reason phrases) are ruled out.

if ($response->getStatusCode() >= 400) {
    // inspect reason phrase and body before parsing token data
}

function isConformantOAuthError(array $data): bool {
    return is_string($data['error'] ?? null) && is_string($data['error_description'] ?? null);
}

try {
    $provider->checkResponse($response, $data);
} catch (IdentityProviderException $e) {
    // log $e->getBody()/status; check provider status page / proxy interference
}

When it happens

Trigger: checkResponse receives an error response (body containing `error`, or non-2xx) whose `error` field is not a string with a string `error_description` — e.g. HTML error pages, JSON with nested/numeric error values, or empty bodies from proxies.

Common situations: Provider outage returning HTML 502/503 pages through a load balancer; corporate proxy intercepting TLS and returning its own error page; provider API version change altering the error payload shape.

Related errors

• $data['error'] (dynamic provider error)
• $data['error'] (dynamic provider error)
• $response->getReasonPhrase() (dynamic provider error)
• Single sign-on failed. Provider error
• AccessToken should be an instance of BaseIdToken class.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/3dee0e7720ea98ea. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/OAuth2/Provider/OAuth2Provider.php:59

        $this->grantFactory->setGrant('jwt_bearer', new JwtBearer());
    }

    /**
     * {@inheritDoc}
     *
     * @throws \Passbolt\Sso\Error\Exception\OAuth2Exception When error and error description is present
     * @throws \League\OAuth2\Client\Provider\Exception\IdentityProviderException When unknown error faced
     */
    protected function checkResponse(ResponseInterface $response, $data): void
    {
        if (empty($data['error'])) {
            return;
        }

        if (is_string($data['error']) && isset($data['error_description']) && is_string($data['error_description'])) {
            throw new OAuth2Exception($data['error'], $data['error_description']);
        } else {
            throw new IdentityProviderException(
                $response->getReasonPhrase(),
                $response->getStatusCode(),
                (string)$response->getBody()
            );
        }
    }

    /**
     * @inheritDoc
     */
    protected function createResourceOwner(array $response, AccessToken $token): ResourceOwnerInterface
    {
        return new OAuth2ResourceOwner($response);
    }
}

View on GitHub (pinned to 31c1bbc10f)