{"record":{"id":"79fc8842fa62855a","repo":"passbolt/passbolt_api","slug":"single-sign-on-failed-the-provider-address-is-not-allowed","errorCode":null,"errorMessage":"Single sign-on failed. The provider address is not allowed.","messagePattern":"Single sign-on failed\\. The provider address is not allowed\\.","errorType":"exception","errorClass":"SsoEgressBlockedException","httpStatus":null,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Utility/Http/SsoEgressGuardMiddleware.php","lineNumber":65,"sourceCode":"\n    /**\n     * Block the request (or warn) when its destination is not allowed by the egress guard.\n     *\n     * @param \\Psr\\Http\\Message\\RequestInterface $request The outgoing request.\n     * @return void\n     * @throws \\Passbolt\\Sso\\Error\\Exception\\SsoEgressBlockedException When blocking is enabled and the host is blocked.\n     */\n    private function assertAllowed(RequestInterface $request): void\n    {\n        $host = $request->getUri()->getHost();\n        $reason = (new SsoEgressGuard())->getBlockReason($host);\n        if ($reason === null) {\n            return;\n        }\n\n        if ((bool)Configure::read(self::CONFIG_BLOCK, false)) {\n            Log::error('SSO egress guard blocked a request. ' . $reason);\n            throw new SsoEgressBlockedException(\n                __('Single sign-on failed.') . ' ' . __('The provider address is not allowed.')\n            );\n        }\n\n        // Warn-only mode: log and let the request through.\n        Log::warning('SSO egress guard (warn-only) flagged a request. ' . $reason);\n    }\n}\n","sourceCodeStart":47,"sourceCodeEnd":74,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Utility/Http/SsoEgressGuardMiddleware.php#L47-L74","documentation":"SsoEgressGuardMiddleware validates every outgoing SSO provider request (and redirect hop) against the SsoEgressGuard allowlist. If the destination host is not allowed and passbolt.security.sso.egress.block is true, it throws SsoEgressBlockedException with this message; in warn-only mode (block=false) it only logs a warning and lets the request through. This is an SSRF mitigation: it prevents a user-supplied provider URL from pointing the server at internal addresses.","triggerScenarios":"Any SSO provider HTTP call (Azure/Google OAuth2, ADFS, PingOne) whose request host fails SsoEgressGuard::getBlockReason() — e.g. an ADFS/PingOne endpoint URL set to an internal host or IP, a redirect to a disallowed host, or a allowlist in passbolt.php that does not cover the configured provider domain.","commonSituations":"Admin configuring a self-hosted ADFS server but forgetting to allowlist its hostname in the SSO egress settings; provider redirecting to a different domain not on the allowlist; hardened installs (block=true) in air-gapped networks; DNS or URL typos pointing at internal addresses.","solutions":["Check the error log for 'SSO egress guard blocked a request.' plus the reason to see which host and why it was blocked.","Add the provider's hostname to the SSO egress allowlist in passbolt configuration (passbolt.security.sso.egress settings).","Fix the SSO provider URL configured in passbolt if it was mistyped or points to an internal address.","Ensure redirect targets of your IdP are also allowed — every redirect hop is re-validated.","Temporarily set passbolt.security.sso.egress.block=false to run warn-only while diagnosing, then re-enable blocking once the allowlist is correct."],"exampleFix":"// before (config/passbolt.php)\n'egress' => ['block' => true, 'allow' => ['login.microsoftonline.com']],\n// after: allowlist the self-hosted ADFS host\n'egress' => ['block' => true, 'allow' => ['login.microsoftonline.com', 'adfs.corp.example.com']],","handlingStrategy":"try-catch","validationCode":"$host = (new Uri($providerUrl))->getHost();\nif ((new SsoEgressGuard())->getBlockReason($host) !== null) {\n    // refuse to configure/use this provider URL before any HTTP call is made\n}","typeGuard":null,"tryCatchPattern":"try {\n    $client = SsoHttpClientFactory::create();\n    $response = $client->send($request);\n} catch (\\Passbolt\\Sso\\Error\\Exception\\SsoEgressBlockedException $e) {\n    $this->log($e->getMessage() . ' (check egress allowlist for the provider host)');\n    return $this->renderError('sso', 'Provider address is not allowed by server policy.');\n}","preventionTips":["Add every IdP hostname (including redirect domains) to the egress allowlist","Run block=false (warn-only) in staging first and review warning logs","Double-check configured provider URLs for internal-host typos","Document the allowlist change procedure for self-hosted ADFS/PingOne installs"],"tags":["sso","ssrf","egress","security","configuration"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}