{"record":{"id":"c5b0fa487459801f","repo":"passbolt/passbolt_api","slug":"invalid-provider-expected-azure-as-provider","errorCode":null,"errorMessage":"Invalid provider. Expected Azure as provider.","messagePattern":"Invalid provider\\. Expected Azure as provider\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/Sso/Azure/SsoAzureService.php","lineNumber":114,"sourceCode":"        return SsoProviderFactory::create(AzureProvider::class, [\n            'clientId' => $data->client_id,\n            'clientSecret' => $data->client_secret,\n            'redirectUri' => Router::url('/sso/azure/redirect', true),\n            'tenant' => $data->tenant_id,\n            'openIdBaseUri' => $data->url ?? null,\n            'emailClaim' => $data->email_claim ?? null,\n        ]);\n    }\n\n    /**\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    protected function assertAndGetSsoSettings(): SsoSettingsDto\n    {\n        try {\n            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);\n            if ($ssoSettings->provider !== SsoSetting::PROVIDER_AZURE) {\n                throw new BadRequestException('Invalid provider. Expected Azure as provider.');\n            }\n            if (!($ssoSettings->data instanceof SsoSettingsAzureDataDto)) {\n                throw new BadRequestException('Invalid provider data. Expected Azure settings.');\n            }\n        } catch (Exception $exception) {\n            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);\n        }\n\n        return $ssoSettings;\n    }\n\n    // OVERRIDDEN METHODS\n\n    /**\n     * @inheritDoc\n     */\n    public function assertResourceOwnerAgainstSsoState(\n        SsoResourceOwnerInterface $resourceOwner,","sourceCodeStart":96,"sourceCodeEnd":132,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/Sso/Azure/SsoAzureService.php#L96-L132","documentation":"The Azure SSO service asserts that the active SSO settings are for the Azure provider before constructing its OAuth2 client. If the active settings' provider is not Azure, a BadRequestException is thrown. This guard ensures the Azure service only processes Azure settings.","triggerScenarios":"An Azure SSO endpoint is reached while the active settings provider is something else (e.g. AD FS or Google), e.g. stale Azure URLs or clients after the admin switched providers.","commonSituations":"Provider switched from Azure to AD FS but browser bookmarks or the extension still call Azure routes; draft saved for a different provider; DB restores with wrong provider rows.","solutions":["Activate Azure SSO settings in passbolt administration if Azure is the intended provider.","Call the endpoint matching the active provider's routes.","Discard mismatched draft settings and create a new Azure settings draft.","Verify the provider column in sso_settings matches 'azure'."],"exampleFix":"// before\n$ssoSettings->provider === 'adfs' but calling SsoAzureService\n// after\nactivate Azure settings so $ssoSettings->provider === SsoSetting::PROVIDER_AZURE","handlingStrategy":"try-catch","validationCode":"$settings = (new SsoSettingsGetService())->get();\nif ($settings->isActive() && $settings->provider !== SsoSetting::PROVIDER_AZURE) {\n    // route to the service matching $settings->provider\n}","typeGuard":null,"tryCatchPattern":"try {\n    $settingsDto = $service->assertAndGetSsoSettings();\n} catch (BadRequestException $e) {\n    if (str_contains($e->getMessage(), 'Invalid provider')) {\n        // activate Azure settings or use the correct provider endpoint\n    }\n    throw $e;\n}","preventionTips":["Match the endpoint/route to the active provider; don't hardcode Azure URLs after switching.","Re-run client setup after provider changes.","Audit sso_settings.provider after restores.","Use dry-run to catch mismatches before real logins."],"tags":["sso","azure","configuration"],"backgroundTag":"invalid-enum-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}