passbolt/passbolt_api · warning · BadRequestException

The ver (version) parameter is invalid.

Error message

The ver (version) parameter is invalid.

What it means

AzureIdToken::assertTokenClaims() enforces that the ID token 'ver' claim is the string '2.0' (AzureProvider::ENDPOINT_VERSION_2_0). Tokens from the Azure AD v1 endpoint (ver=1.0) are rejected because the plugin only supports the v2.0 endpoint.

Solutions

1. Point the OpenID configuration / discovery URL to the v2.0 endpoint ( .../v2.0/.well-known/openid-configuration )
2. Re-register or update the Azure app to use the v2.0 endpoint
3. Re-run the SSO setup so passbolt caches the v2.0 metadata
4. Decode the received token to confirm the ver value and issue it again after endpoint correction

Example fix

// before (v1 discovery)
$openIdConfig = 'https://login.microsoftonline.com/{tenant}/.well-known/openid-configuration';
// after (v2.0)
$openIdConfig = 'https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration';

$claims = json_decode(base64_decode(strtr(explode('.', $idToken)[1], '-_', '+/')), true); if (($claims['ver'] ?? null) !== '2.0') { /* v1 token, fix discovery URL */ }

function isV2Token(?string $ver): bool { return $ver === '2.0'; }

try { AzureIdToken::assertTokenClaims($claims); } catch (BadRequestException $e) { Log::error('Non-v2.0 Azure ID token: check openid-config URL'); throw $e; }

When it happens

Trigger: A v1.0 ID token is submitted — either the OpenID configuration URL used is the v1 one, or the Azure app was created/registered against the legacy endpoint.

Common situations: Well-known config pointing to login.microsoftonline.com/{tenant}/.well-known/openid-configuration instead of the v2.0 variant; Azure app registered as legacy; a proxy or cached discovery document serving v1 metadata; custom token issuance defaulting to v1.

Related errors

• Cannot parse JWKS endpoint response.
• The tid (tenant id) parameter is invalid.
• error
• Invalid JWKS endpoint response. Keys missing.
• JWT token is missing.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/d7a8033dd6ca5243. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Utility/Azure/OpenId/AzureIdToken.php:58

     *
     * Override this method to perform provider specific assertions.
     */
    public function assertTokenClaims(array $tokenClaims): void
    {
        parent::assertTokenClaims($tokenClaims);

        if (
            !isset($tokenClaims['tid']) || !is_string($tokenClaims['tid']) ||
            $this->provider->getTenant() != $tokenClaims['tid']
        ) {
            throw new BadRequestException('The tid (tenant id) parameter is invalid.');
        }

        if (
            !isset($tokenClaims['ver']) || !is_string($tokenClaims['ver']) ||
            $tokenClaims['ver'] != AzureProvider::ENDPOINT_VERSION_2_0
        ) {
            throw new BadRequestException('The ver (version) parameter is invalid.');
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)