{"record":{"id":"915261d2682107a1","repo":"passbolt/passbolt_api","slug":"invalid-provider-data-expected-ad-fs-settings","errorCode":null,"errorMessage":"Invalid provider data. Expected AD FS settings.","messagePattern":"Invalid provider data\\. Expected AD FS settings\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/Sso/Adfs/SsoAdfsService.php","lineNumber":68,"sourceCode":"                'openIdConfigurationPath' => $data->openid_configuration_path,\n                'emailClaim' => $data->email_claim,\n            ],\n            ['httpClient' => $this->getCustomHttpClient()]\n        );\n    }\n\n    /**\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    protected function assertAndGetSsoSettings(): SsoSettingsDto\n    {\n        try {\n            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);\n            if ($ssoSettings->provider !== SsoSetting::PROVIDER_ADFS) {\n                throw new BadRequestException(__('Invalid provider. Expected AD FS.'));\n            }\n            if (!($ssoSettings->data instanceof SsoSettingsAdfsDataDto)) {\n                throw new BadRequestException(__('Invalid provider data. Expected AD FS settings.'));\n            }\n        } catch (Exception $exception) {\n            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);\n        }\n\n        return $ssoSettings;\n    }\n}\n","sourceCodeStart":50,"sourceCodeEnd":77,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/Sso/Adfs/SsoAdfsService.php#L50-L77","documentation":"When the active settings declare AD FS as provider, their data payload must deserialize into SsoSettingsAdfsDataDto. If the stored data object is of another DTO type, the settings are inconsistent and a BadRequestException is thrown.","triggerScenarios":"sso_settings row has provider=AD FS but its data column was stored/decoded as a different provider's DTO (e.g. Azure data) — typically after manual DB edits, restores, or a bug persisting mismatched draft data.","commonSituations":"Database restored from a backup mixing settings versions; admin edited sso_settings directly; a plugin version upgrade changed DTO classes while old serialized data remained.","solutions":["Re-create the AD FS SSO settings through the administration UI so a matching SsoSettingsAdfsDataDto is persisted.","Inspect the sso_settings table and fix/remove the inconsistent row (provider vs data).","Run the SSO dry-run after reconfiguring to confirm the settings validate.","Ensure passbolt SSO plugin versions match on all nodes before restoring shared databases."],"exampleFix":"// before\nprovider: 'adfs', data: SsoSettingsAzureDataDto\n// after\nre-save settings so provider: 'adfs', data: SsoSettingsAdfsDataDto","handlingStrategy":"try-catch","validationCode":"$settings = (new SsoSettingsGetService())->get();\nif ($settings->provider === SsoSetting::PROVIDER_ADFS\n    && !($settings->data instanceof SsoSettingsAdfsDataDto)) {\n    // re-save AD FS settings via the UI before using them\n}","typeGuard":null,"tryCatchPattern":"try {\n    $settingsDto = $service->assertAndGetSsoSettings();\n} catch (BadRequestException $e) {\n    if (str_contains($e->getMessage(), 'Invalid provider data')) {\n        // recreate AD FS settings via administration UI\n    }\n    throw $e;\n}","preventionTips":["Never edit sso_settings rows manually; always reconfigure via the UI.","Re-save SSO settings after plugin upgrades or restores.","Keep DTO/provider pairs consistent when persisting drafts.","Run dry-run validation after any settings change."],"tags":["sso","adfs","configuration","dto"],"backgroundTag":"type-mismatch","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}