passbolt/passbolt_api · error · InternalErrorException

The configuration value should be one of the following: .

Error message

The {0} configuration value should be one of the following: {1}.

What it means

assertJwkDefaultAlg() also constrains the defaultAlg config to the JWS 'alg' values allowed by RFC 7518 (HS256/384/512, RS256/384/512, ES384, ES256). If passbolt.plugins.sso.security.jwks.defaultAlg is a string but not in this whitelist, getJwtVerificationKeys() throws this InternalErrorException.

Solutions

1. Set the config to one of: HS256, HS384, HS512, RS256, RS384, RS512, ES384, ES256
2. Use uppercase exactly as listed (the check is case-sensitive via in_array)
3. If unsure, remove the config key so NULL is used and the JWK's own alg is respected
4. Match the algorithm actually used by your IdP for signing id_tokens (commonly RS256)

Example fix

// before
'jwks' => ['defaultAlg' => 'PS256'],
// after
'jwks' => ['defaultAlg' => 'RS256'],

$allowed = ['HS256','HS384','HS512','RS256','RS384','RS512','ES384','ES256'];
$defaultAlg = Configure::read('passbolt.plugins.sso.security.jwks.defaultAlg');
if (is_string($defaultAlg) && !in_array($defaultAlg, $allowed, true)) {
    throw new \InvalidArgumentException("defaultAlg '$defaultAlg' not allowed; use one of " . implode(',', $allowed));
}

When it happens

Trigger: Setting passbolt.plugins.sso.security.jwks.defaultAlg to an unsupported string such as 'RS1', 'none', 'PS256', or a lowercase 'rs256'.

Common situations: Administrators guessing algorithm names instead of using the documented list; enabling a 'none' algorithm for debugging; typos or case-sensitivity mistakes in config.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• The configuration value should be a string or NULL.
• Cannot parse JWKS endpoint response.
• Cannot parse JWKS endpoint response.
• Failed to public key properties from certificate
• Failed to read certificate

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/4dcf0f15017d2bf6. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/Provider/AbstractOauth2Provider.php:325

     * @throws \Cake\Http\Exception\InternalErrorException When configuration value is invalid.
     */
    private function assertJwkDefaultAlg(mixed $defaultAlg): void
    {
        if (!is_null($defaultAlg) && !is_string($defaultAlg)) {
            throw new InternalErrorException(__(
                'The {0} configuration value should be a string or NULL.',
                'passbolt.plugins.sso.security.jwks.defaultAlg'
            ));
        }

        /**
         * "alg" (Algorithm) Header Parameter Values for JWS.
         *
         * @link https://datatracker.ietf.org/doc/html/rfc7518#section-3
         */
        $allowedAlgValues = ['HS256', 'HS384', 'HS512', 'RS256', 'RS384', 'RS512', 'ES384', 'ES256'];
        if (is_string($defaultAlg) && !in_array($defaultAlg, $allowedAlgValues)) {
            throw new InternalErrorException(__(
                'The {0} configuration value should be one of the following: {1}.',
                'passbolt.plugins.sso.security.jwks.defaultAlg',
                implode(', ', $allowedAlgValues)
            ));
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)