{"record":{"id":"a956a1129a5e80db","repo":"passbolt/passbolt_api","slug":"invalid-provider-expected-pingone","errorCode":null,"errorMessage":"Invalid provider. Expected PingOne.","messagePattern":"Invalid provider\\. Expected PingOne\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/Sso/PingOne/SsoPingOneService.php","lineNumber":66,"sourceCode":"                'redirectUri' => Router::url('/sso/pingone/redirect', true),\n                'openIdBaseUri' => $data->url,\n                'openIdConfigurationPath' => $data->openid_configuration_path,\n                'environmentId' => $data->environment_id,\n                'emailClaim' => $data->email_claim,\n            ],\n            ['httpClient' => $this->getCustomHttpClient()]\n        );\n    }\n\n    /**\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    protected function assertAndGetSsoSettings(): SsoSettingsDto\n    {\n        try {\n            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);\n            if ($ssoSettings->provider !== SsoSetting::PROVIDER_PINGONE) {\n                throw new BadRequestException(__('Invalid provider. Expected PingOne.'));\n            }\n            if (!($ssoSettings->data instanceof SsoSettingsPingOneDataDto)) {\n                throw new BadRequestException(__('Invalid provider data. Expected PingOne settings.'));\n            }\n        } catch (Exception $exception) {\n            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);\n        }\n\n        return $ssoSettings;\n    }\n}\n","sourceCodeStart":48,"sourceCodeEnd":78,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/Sso/PingOne/SsoPingOneService.php#L48-L78","documentation":"Consistency guard in the SSO PingOne service: the active SSO settings DTO being processed names a provider other than pingone, so the settings do not belong to this service and further PingONE operations are refused.","triggerScenarios":"SSO request routed to the PingOne service while active settings specify google, azure, or oauth2; provider switched away from PingOne after a client started the SSO flow.","commonSituations":"Admin replaced PingOne with another provider while users had pending SSO state; wrong provider endpoint invoked; manually edited sso_settings.provider value; settings cache stale after provider change.","solutions":["Verify active SSO settings have provider 'pingone' via admin settings or SsoSettingsGetService","Call the SSO endpoint/service corresponding to the actually configured provider","Re-save PingOne settings and clear cached settings if provider changed recently","Remove stale pending SSO state on clients after provider switches"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"$settings = (new SsoSettingsGetService())->getActiveOrFail(true);\nif ($settings->provider !== SsoSetting::PROVIDER_PINGONE) {\n    // use the service matching $settings->provider\n}","typeGuard":"if (!$ssoSettings instanceof SsoSettingsDto || $ssoSettings->provider !== SsoSetting::PROVIDER_PINGONE) {\n    return null;\n}","tryCatchPattern":"try {\n    $settings = $pingOneService->assertAndGetSsoSettings();\n} catch (BadRequestException $e) {\n    // fall back to the configured provider's SSO service\n}","preventionTips":["Dispatch SSO requests based on active settings provider, not a fixed service","Clear cached settings after provider switches","Clean up pending SSO state on clients when the provider changes"],"tags":["sso","pingone","provider-mismatch","configuration"],"backgroundTag":"invalid-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}