{"record":{"id":"5154d42e17c4727d","repo":"passbolt/passbolt_api","slug":"invalid-provider-expected-ad-fs","errorCode":null,"errorMessage":"Invalid provider. Expected AD FS.","messagePattern":"Invalid provider\\. Expected AD FS\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/Sso/Adfs/SsoAdfsService.php","lineNumber":65,"sourceCode":"                'clientSecret' => $data->client_secret,\n                'redirectUri' => Router::url('/sso/adfs/redirect', true),\n                'openIdBaseUri' => $data->url,\n                'openIdConfigurationPath' => $data->openid_configuration_path,\n                'emailClaim' => $data->email_claim,\n            ],\n            ['httpClient' => $this->getCustomHttpClient()]\n        );\n    }\n\n    /**\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    protected function assertAndGetSsoSettings(): SsoSettingsDto\n    {\n        try {\n            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);\n            if ($ssoSettings->provider !== SsoSetting::PROVIDER_ADFS) {\n                throw new BadRequestException(__('Invalid provider. Expected AD FS.'));\n            }\n            if (!($ssoSettings->data instanceof SsoSettingsAdfsDataDto)) {\n                throw new BadRequestException(__('Invalid provider data. Expected AD FS settings.'));\n            }\n        } catch (Exception $exception) {\n            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);\n        }\n\n        return $ssoSettings;\n    }\n}\n","sourceCodeStart":47,"sourceCodeEnd":77,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/Sso/Adfs/SsoAdfsService.php#L47-L77","documentation":"The AD FS SSO service asserts that the active SSO settings on the server are for the AD FS provider before building its OAuth2 client. If the active settings have a different provider value, a BadRequestException is thrown. This is a configuration guard ensuring the correct service handles the request.","triggerScenarios":"An AD FS SSO endpoint (auth/start, verify, dry-run) is hit while the active SSO settings stored in the database are for another provider (e.g. Azure or Google).","commonSituations":"Admin switched the SSO provider from Azure to AD FS (or vice versa) but old AD FS URLs/bookmarks or clients still call the AD FS route; the settings draft was saved for another provider; environment restores where sso_settings rows point to a different provider.","solutions":["Open SSO settings in passbolt administration and confirm the active provider is AD FS; reconfigure and activate AD FS settings if not.","Use the correct provider endpoint/route matching the active settings (e.g. Azure routes for Azure settings).","If a draft is stuck, delete/discard the draft settings and create a new AD FS settings draft.","Verify sso_settings table row (provider column) matches the intended provider after restores or migrations."],"exampleFix":"// before\n$ssoSettings->provider === 'azure' but calling SsoAdfsService\n// after\nactivate AD FS settings so $ssoSettings->provider === SsoSetting::PROVIDER_ADFS","handlingStrategy":"try-catch","validationCode":"$settings = (new SsoSettingsGetService())->get();\nif ($settings->isActive() && $settings->provider !== SsoSetting::PROVIDER_ADFS) {\n    // use the service matching $settings->provider instead of SsoAdfsService\n}","typeGuard":null,"tryCatchPattern":"try {\n    $settingsDto = $service->assertAndGetSsoSettings();\n} catch (BadRequestException $e) {\n    if (str_contains($e->getMessage(), 'Invalid provider')) {\n        // reconfigure or route to the correct provider service\n    }\n    throw $e;\n}","preventionTips":["Activate only one provider's settings and call that provider's endpoints/routes.","After switching providers, invalidate old bookmarks and client caches.","Check the provider value in sso_settings after DB restores.","Use dry-run to detect provider/settings mismatch early."],"tags":["sso","adfs","configuration"],"backgroundTag":"invalid-enum-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}