{"record":{"id":"545196f130b237e9","repo":"passbolt/passbolt_api","slug":"invalid-provider-data-expected-azure-settings","errorCode":null,"errorMessage":"Invalid provider data. Expected Azure settings.","messagePattern":"Invalid provider data\\. Expected Azure settings\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/Sso/Azure/SsoAzureService.php","lineNumber":117,"sourceCode":"            'redirectUri' => Router::url('/sso/azure/redirect', true),\n            'tenant' => $data->tenant_id,\n            'openIdBaseUri' => $data->url ?? null,\n            'emailClaim' => $data->email_claim ?? null,\n        ]);\n    }\n\n    /**\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    protected function assertAndGetSsoSettings(): SsoSettingsDto\n    {\n        try {\n            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);\n            if ($ssoSettings->provider !== SsoSetting::PROVIDER_AZURE) {\n                throw new BadRequestException('Invalid provider. Expected Azure as provider.');\n            }\n            if (!($ssoSettings->data instanceof SsoSettingsAzureDataDto)) {\n                throw new BadRequestException('Invalid provider data. Expected Azure settings.');\n            }\n        } catch (Exception $exception) {\n            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);\n        }\n\n        return $ssoSettings;\n    }\n\n    // OVERRIDDEN METHODS\n\n    /**\n     * @inheritDoc\n     */\n    public function assertResourceOwnerAgainstSsoState(\n        SsoResourceOwnerInterface $resourceOwner,\n        SsoState $ssoState\n    ): void {\n        parent::assertResourceOwnerAgainstSsoState($resourceOwner, $ssoState);","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/Sso/Azure/SsoAzureService.php#L99-L135","documentation":"When the active settings declare Azure as provider, their data must be an instance of SsoSettingsAzureDataDto. If the stored data payload is a different DTO type, settings are inconsistent and a BadRequestException is thrown.","triggerScenarios":"sso_settings row has provider=Azure but its data decodes to another provider's DTO — typically after manual DB edits, restores, or mismatched persisted drafts.","commonSituations":"Backup restores mixing settings; direct DB manipulation; plugin upgrade changing DTO classes while old data persisted.","solutions":["Re-create Azure SSO settings via the administration UI so the data is persisted as SsoSettingsAzureDataDto.","Inspect and fix the inconsistent sso_settings row (provider vs data).","Run SSO dry-run to confirm settings validate after reconfiguration.","Keep passbolt SSO plugin versions consistent across nodes and restores."],"exampleFix":"// before\nprovider: 'azure', data: SsoSettingsAdfsDataDto\n// after\nre-save settings so provider: 'azure', data: SsoSettingsAzureDataDto","handlingStrategy":"try-catch","validationCode":"$settings = (new SsoSettingsGetService())->get();\nif ($settings->provider === SsoSetting::PROVIDER_AZURE\n    && !($settings->data instanceof SsoSettingsAzureDataDto)) {\n    // re-save Azure settings via the UI before use\n}","typeGuard":null,"tryCatchPattern":"try {\n    $settingsDto = $service->assertAndGetSsoSettings();\n} catch (BadRequestException $e) {\n    if (str_contains($e->getMessage(), 'Invalid provider data')) {\n        // recreate Azure settings via administration UI\n    }\n    throw $e;\n}","preventionTips":["Persist Azure settings only through the settings form so the correct DTO is stored.","Avoid direct DB edits on sso_settings.","Re-save settings after plugin version changes or restores.","Validate with dry-run after every settings change."],"tags":["sso","azure","configuration","dto"],"backgroundTag":"type-mismatch","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}