passbolt/passbolt_api · warning · BadRequestException

The tid (tenant id) parameter is invalid.

Error message

The tid (tenant id) parameter is invalid.

What it means

AzureIdToken::assertTokenClaims() validates Azure AD-specific ID token claims after generic JWT validation. It requires a string 'tid' claim equal to the configured tenant ID; any mismatch or absence throws BadRequestException, guarding against tokens issued for a different Azure tenant.

Solutions

1. Verify the tenant ID in passbolt SSO settings matches the 'tid' claim (decode the ID token to check)
2. Restrict the Azure app to the correct tenant (signInAudience = AzureADMyOrg) or update settings for multi-tenant use
3. Ensure users sign in with accounts from the configured tenant only
4. Check you are using the v2.0 endpoint consistently (see related 'ver' check)

Example fix

// before: tenant GUID mismatch
Configure::write('passbolt.security.sso.provider.azureAd.tenantId', 'wrong-guid');
// after: use Directory (tenant) ID from Azure portal
Configure::write('passbolt.security.sso.provider.azureAd.tenantId', '00000000-0000-0000-0000-000000000000');

$claims = json_decode(base64_decode(strtr(explode('.', $idToken)[1], '-_', '+/')), true); if (($claims['tid'] ?? null) !== $expectedTenantId) { /* tenant mismatch, stop before verification */ }

function isExpectedTenant(?string $tid, string $expected): bool { return is_string($tid) && $tid === $expected; }

try { AzureIdToken::assertTokenClaims($claims); } catch (BadRequestException $e) { return $this->respondError(401, 'ID token was issued for a different tenant.'); }

When it happens

Trigger: An Azure ID token is presented whose 'tid' claim is missing, not a string, or does not equal the tenant configured in the Azure provider settings.

Common situations: User authenticating with a personal Microsoft account or a different work tenant than the one configured; multi-tenant app misconfig; tenant ID copy-paste error (wrong GUID) in passbolt SSO settings; token obtained from the v1 endpoint.

Related errors

• Cannot parse JWKS endpoint response.
• The ver (version) parameter is invalid.
• Could not save the SSO state, invalid nonce.
• Could not validate the SSO recover request.
• error

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/50d106f78a2db02d. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/Azure/OpenId/AzureIdToken.php:51

/**
 * @property \Passbolt\Sso\Utility\Azure\Provider\AzureProvider $provider
 */
class AzureIdToken extends BaseIdToken
{
    /**
     * {@inheritDoc}
     *
     * Override this method to perform provider specific assertions.
     */
    public function assertTokenClaims(array $tokenClaims): void
    {
        parent::assertTokenClaims($tokenClaims);

        if (
            !isset($tokenClaims['tid']) || !is_string($tokenClaims['tid']) ||
            $this->provider->getTenant() != $tokenClaims['tid']
        ) {
            throw new BadRequestException('The tid (tenant id) parameter is invalid.');
        }

        if (
            !isset($tokenClaims['ver']) || !is_string($tokenClaims['ver']) ||
            $tokenClaims['ver'] != AzureProvider::ENDPOINT_VERSION_2_0
        ) {
            throw new BadRequestException('The ver (version) parameter is invalid.');
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)