{"record":{"id":"8a7785184c900182","repo":"passbolt/passbolt_api","slug":"invalid-provider-expected-google-as-provider","errorCode":null,"errorMessage":"Invalid provider. Expected Google as provider.","messagePattern":"Invalid provider\\. Expected Google as provider\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/Sso/Google/SsoGoogleService.php","lineNumber":85,"sourceCode":"        /** @var \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsGoogleDataDto $data */\n        $data = $settings->data;\n\n        return SsoProviderFactory::create(GoogleProvider::class, [\n            'clientId' => $data->client_id,\n            'clientSecret' => $data->client_secret,\n            'redirectUri' => Router::url('/sso/google/redirect', true),\n        ]);\n    }\n\n    /**\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    protected function assertAndGetSsoSettings(): SsoSettingsDto\n    {\n        try {\n            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);\n            if ($ssoSettings->provider !== SsoSetting::PROVIDER_GOOGLE) {\n                throw new BadRequestException('Invalid provider. Expected Google as provider.');\n            }\n            if (!($ssoSettings->data instanceof SsoSettingsGoogleDataDto)) {\n                throw new BadRequestException('Invalid provider data. Expected Google settings.');\n            }\n        } catch (Exception $exception) {\n            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);\n        }\n\n        return $ssoSettings;\n    }\n\n    // HELPERS\n}\n","sourceCodeStart":67,"sourceCodeEnd":99,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/Sso/Google/SsoGoogleService.php#L67-L99","documentation":"This error is thrown by SsoGoogleService::assertAndGetSsoSettings when the active SSO settings stored in the database have a provider that is not 'google'. The Google SSO service only processes authentication requests when Google is the configured provider, so it validates the active settings before use.","triggerScenarios":"An SSO flow routed to the Google service (e.g. SSO login/registration) while the active SSO settings in sso_settings have provider set to another value (azure, oauth2, pingone) or were changed after the request was generated.","commonSituations":"Admin switched the SSO provider from Google to another provider (e.g. during a migration to OAuth2/PingOne) while clients still had pending Google-based SSO state; stale settings cache serving outdated provider; misconfigured environment pointing at the wrong organization settings.","solutions":["Check the active SSO settings (admin UI or `SsoSettingsGetService->getActiveOrFail()`) and confirm the provider is set to Google","If another provider is intended, use the corresponding SSO service/endpoint for that provider instead of the Google one","Re-save the Google SSO settings to refresh the active settings if a stale/corrupted entry is active","Clear the SSO settings cache after changing providers so requests pick up the new active configuration"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"$settings = (new SsoSettingsGetService())->getActiveOrFail(true);\nif ($settings->provider !== SsoSetting::PROVIDER_GOOGLE) {\n    // route to the correct provider service instead of Google's\n}","typeGuard":"if (!$ssoSettings instanceof SsoSettingsDto || $ssoSettings->provider !== SsoSetting::PROVIDER_GOOGLE) {\n    return null;\n}","tryCatchPattern":"try {\n    $settings = $googleService->assertAndGetSsoSettings();\n} catch (BadRequestException $e) {\n    // inspect $e->getPrevious() and fall back to the matching provider service\n}","preventionTips":["Route SSO requests dynamically based on the active settings provider, not a hardcoded service","Clear settings cache after any provider change","Check the active provider in the admin UI before testing Google SSO"],"tags":["sso","google","provider-mismatch","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}