{"record":{"id":"8e459d3fd4dbc52f","repo":"passbolt/passbolt_api","slug":"invalid-provider-expected-oauth2","errorCode":null,"errorMessage":"Invalid provider. Expected OAuth2.","messagePattern":"Invalid provider\\. Expected OAuth2\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/Sso/OAuth2/SsoOAuth2Service.php","lineNumber":102,"sourceCode":"                'clientId' => $data->client_id,\n                'clientSecret' => $data->client_secret,\n                'redirectUri' => Router::url('/sso/oauth2/redirect', true),\n                'openIdBaseUri' => $data->url,\n                'openIdConfigurationPath' => $data->openid_configuration_path,\n            ],\n            ['httpClient' => $this->getCustomHttpClient()]\n        );\n    }\n\n    /**\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    protected function assertAndGetSsoSettings(): SsoSettingsDto\n    {\n        try {\n            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);\n            if ($ssoSettings->provider !== SsoSetting::PROVIDER_OAUTH2) {\n                throw new BadRequestException('Invalid provider. Expected OAuth2.');\n            }\n            if (!($ssoSettings->data instanceof SsoSettingsOAuth2DataDto)) {\n                throw new BadRequestException('Invalid provider data. Expected OAuth2 settings.');\n            }\n        } catch (Exception $exception) {\n            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);\n        }\n\n        return $ssoSettings;\n    }\n}\n","sourceCodeStart":84,"sourceCodeEnd":114,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/Sso/OAuth2/SsoOAuth2Service.php#L84-L114","documentation":"Thrown by the OAuth2 SsoOAuth2Service::assertAndGetSsoSettings when the active SSO settings provider is not PROVIDER_OAUTH2. The generic OAuth2 service only accepts settings whose provider is oauth2 before starting the SSO flow.","triggerScenarios":"An SSO request routed to the OAuth2 service while active settings have provider google, azure, or pingone; or the settings were switched away from OAuth2 between generating the SSO link and the callback.","commonSituations":"Admin migrated from generic OAuth2 to a first-class provider (Google/PingOne) leaving stale client state; wrong SSO endpoint called for the configured provider; database row edited manually changing provider value.","solutions":["Confirm the active SSO settings provider is 'oauth2' via the admin settings or SsoSettingsGetService","Use the SSO service/endpoint matching the actually configured provider (Google, PingOne, Azure)","Re-save OAuth2 settings and clear any cached settings if the provider was recently changed","Search client-side for hardcoded OAuth2 provider references that should be dynamic"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"$settings = (new SsoSettingsGetService())->getActiveOrFail(true);\nif ($settings->provider !== SsoSetting::PROVIDER_OAUTH2) {\n    // dispatch to the service matching $settings->provider\n}","typeGuard":"if (!$ssoSettings instanceof SsoSettingsDto || $ssoSettings->provider !== SsoSetting::PROVIDER_OAUTH2) {\n    return null;\n}","tryCatchPattern":"try {\n    $settings = $oauth2Service->assertAndGetSsoSettings();\n} catch (BadRequestException $e) {\n    // route to the configured provider's service instead\n}","preventionTips":["Resolve the SSO service from the active settings provider rather than hardcoding OAuth2","Invalidate cached settings whenever the provider changes","Confirm provider value in admin SSO settings before running OAuth2 flows"],"tags":["sso","oauth2","provider-mismatch","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}