{"record":{"id":"13d480c124a3edb3","repo":"passbolt/passbolt_api","slug":"invalid-provider-data-expected-oauth2-settings","errorCode":null,"errorMessage":"Invalid provider data. Expected OAuth2 settings.","messagePattern":"Invalid provider data\\. Expected OAuth2 settings\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/Sso/OAuth2/SsoOAuth2Service.php","lineNumber":105,"sourceCode":"                'openIdBaseUri' => $data->url,\n                'openIdConfigurationPath' => $data->openid_configuration_path,\n            ],\n            ['httpClient' => $this->getCustomHttpClient()]\n        );\n    }\n\n    /**\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    protected function assertAndGetSsoSettings(): SsoSettingsDto\n    {\n        try {\n            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);\n            if ($ssoSettings->provider !== SsoSetting::PROVIDER_OAUTH2) {\n                throw new BadRequestException('Invalid provider. Expected OAuth2.');\n            }\n            if (!($ssoSettings->data instanceof SsoSettingsOAuth2DataDto)) {\n                throw new BadRequestException('Invalid provider data. Expected OAuth2 settings.');\n            }\n        } catch (Exception $exception) {\n            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);\n        }\n\n        return $ssoSettings;\n    }\n}\n","sourceCodeStart":87,"sourceCodeEnd":114,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/Sso/OAuth2/SsoOAuth2Service.php#L87-L114","documentation":"Thrown by SsoOAuth2Service::assertAndGetSsoSettings when provider is oauth2 but the settings `data` is not an instance of SsoSettingsOAuth2DataDto, meaning the stored payload does not contain valid OAuth2 settings fields (client id, tenant, endpoints, etc.).","triggerScenarios":"sso_settings row has provider='oauth2' while its data deserializes to another provider's DTO (e.g. Google or PingOne data), from a mismatched update where provider and data were changed inconsistently, or legacy/failed migration data.","commonSituations":"Partial provider migration where only the provider string was updated; manual database edits; restore of settings dump combining incompatible provider/data pairs; bug in settings save path writing wrong DTO for oauth2.","solutions":["Re-save OAuth2 SSO settings through the admin UI/API so the data payload matches SsoSettingsOAuth2DataDto","Inspect the sso_settings data column for oauth2-specific keys (client_id, client_secret, tenant_id, etc.) and fix corrupt entries","Check DTO hydration logic in SsoSettingsGetService for provider-to-DTO mapping regressions after upgrades","Always update provider and its data together in a single settings submission"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$settings = (new SsoSettingsGetService())->getActiveOrFail(true);\nif (!($settings->data instanceof SsoSettingsOAuth2DataDto)) {\n    throw new BadRequestException(__('OAuth2 settings data is invalid; re-save the settings.'));\n}","typeGuard":"if (!($ssoSettings->data instanceof SsoSettingsOAuth2DataDto)) {\n    return null;\n}","tryCatchPattern":"try {\n    $settings = $oauth2Service->assertAndGetSsoSettings();\n} catch (BadRequestException $e) {\n    // ask admin to re-save OAuth2 settings to rebuild the data payload\n}","preventionTips":["Submit provider and matching data together when changing settings","Re-save OAuth2 settings after upgrades affecting DTO hydration","Avoid direct database edits to sso_settings"],"tags":["sso","oauth2","settings-data","type-mismatch"],"backgroundTag":"type-mismatch","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}