passbolt/passbolt_api · error · BadRequestException

Invalid provider data. Expected AD FS settings.

Error message

Invalid provider data. Expected AD FS settings.

What it means

When the active settings declare AD FS as provider, their data payload must deserialize into SsoSettingsAdfsDataDto. If the stored data object is of another DTO type, the settings are inconsistent and a BadRequestException is thrown.

Solutions

1. Re-create the AD FS SSO settings through the administration UI so a matching SsoSettingsAdfsDataDto is persisted.
2. Inspect the sso_settings table and fix/remove the inconsistent row (provider vs data).
3. Run the SSO dry-run after reconfiguring to confirm the settings validate.
4. Ensure passbolt SSO plugin versions match on all nodes before restoring shared databases.

Example fix

// before
provider: 'adfs', data: SsoSettingsAzureDataDto
// after
re-save settings so provider: 'adfs', data: SsoSettingsAdfsDataDto

$settings = (new SsoSettingsGetService())->get();
if ($settings->provider === SsoSetting::PROVIDER_ADFS
    && !($settings->data instanceof SsoSettingsAdfsDataDto)) {
    // re-save AD FS settings via the UI before using them
}

try {
    $settingsDto = $service->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    if (str_contains($e->getMessage(), 'Invalid provider data')) {
        // recreate AD FS settings via administration UI
    }
    throw $e;
}

When it happens

Trigger: sso_settings row has provider=AD FS but its data column was stored/decoded as a different provider's DTO (e.g. Azure data) — typically after manual DB edits, restores, or a bug persisting mismatched draft data.

Common situations: Database restored from a backup mixing settings versions; admin edited sso_settings directly; a plugin version upgrade changed DTO classes while old serialized data remained.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• Invalid provider data. Expected Azure settings.
• Invalid provider. Expected AD FS.
• No valid SSO settings found.
• error
• Invalid provider. Expected Azure as provider.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/915261d2682107a1. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/Adfs/SsoAdfsService.php:68

                'openIdConfigurationPath' => $data->openid_configuration_path,
                'emailClaim' => $data->email_claim,
            ],
            ['httpClient' => $this->getCustomHttpClient()]
        );
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_ADFS) {
                throw new BadRequestException(__('Invalid provider. Expected AD FS.'));
            }
            if (!($ssoSettings->data instanceof SsoSettingsAdfsDataDto)) {
                throw new BadRequestException(__('Invalid provider data. Expected AD FS settings.'));
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }
}

View on GitHub (pinned to 31c1bbc10f)