passbolt/passbolt_api · error · BadRequestException

The iss (issuer) parameter is invalid.

Error message

The iss (issuer) parameter is invalid.

What it means

assertIssClaim first checks that the `iss` claim exists and is a string; otherwise it throws BadRequestException('The iss (issuer) parameter is invalid.'). The iss claim identifies who issued the token and is the first half of issuer validation before comparing against the provider's base URI.

Solutions

1. Inspect the decoded token payload to confirm an `iss` string claim exists (debugEnabled logging or jwt.io).
2. Obtain a fresh token from the correct provider endpoint — tokens missing iss were not issued by the expected OIDC flow.
3. Verify the provider configuration (discovery document) actually advertises and includes standard claims.
4. Ensure you are validating the id_token, not another token type (e.g. access token) that may omit iss.

if (!isset($claims['iss']) || !is_string($claims['iss'])) {
    throw new RuntimeException('id_token missing string iss claim');
}

function hasStringIss(array $claims): bool {
    return isset($claims['iss']) && is_string($claims['iss']) && $claims['iss'] !== '';
}

try {
    $token->assertTokenClaims($claims);
} catch (BadRequestException $e) {
    if (str_contains($e->getMessage(), 'iss (issuer) parameter is invalid')) { /* token lacks iss; not from expected OIDC flow */ }
}

When it happens

Trigger: assertTokenClaims runs assertIssClaim on claims where the `iss` key is absent or not a string — a token issued without an iss claim or with a non-string (null/array) value.

Common situations: Custom or misbehaving providers omitting iss; tokens minted by a different service without OIDC-standard claims; corrupted token payload after manual edits.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• The iss (issuer) parameter does not match.
• No claims
• The aud (client id) parameter is invalid.
• The email claim is not found or invalid.
• JWT token is missing.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/769d2db338d6f435. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/OpenId/BaseIdToken.php:145

        $emailClaim = Configure::read('passbolt.plugins.sso.security.oauth2.emailClaimAlias') ?? 'email';

        if (!isset($tokenClaims[$emailClaim]) || !EmailValidationRule::check($tokenClaims[$emailClaim])) {
            throw new BadRequestException('The email claim is not found or invalid.');
        }
    }

    /**
     * Validate issuer against provider base uri
     * Allows for trailing slash variations
     *
     * @param array $tokenClaims claims
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException if the claim does not validate
     */
    public function assertIssClaim(array $tokenClaims): void
    {
        if (!isset($tokenClaims['iss']) || !is_string($tokenClaims['iss'])) {
            throw new BadRequestException('The iss (issuer) parameter is invalid.');
        }

        $openIdBaseUri = rtrim($this->provider->getOpenIdBaseUri(), '/');
        $iss = rtrim($tokenClaims['iss'], '/');
        if ($iss !== $openIdBaseUri) {
            throw new BadRequestException('The iss (issuer) parameter does not match.');
        }
    }

    /**
     * https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3
     *
     * @param array $tokenClaims claims
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException if the claim does not validate
     */
    public function assertAudClaim(array $tokenClaims): void
    {

View on GitHub (pinned to 31c1bbc10f)