passbolt/passbolt_api · error · BadRequestException

Invalid provider data. Expected Azure settings.

Error message

Invalid provider data. Expected Azure settings.

What it means

When the active settings declare Azure as provider, their data must be an instance of SsoSettingsAzureDataDto. If the stored data payload is a different DTO type, settings are inconsistent and a BadRequestException is thrown.

Solutions

1. Re-create Azure SSO settings via the administration UI so the data is persisted as SsoSettingsAzureDataDto.
2. Inspect and fix the inconsistent sso_settings row (provider vs data).
3. Run SSO dry-run to confirm settings validate after reconfiguration.
4. Keep passbolt SSO plugin versions consistent across nodes and restores.

Example fix

// before
provider: 'azure', data: SsoSettingsAdfsDataDto
// after
re-save settings so provider: 'azure', data: SsoSettingsAzureDataDto

$settings = (new SsoSettingsGetService())->get();
if ($settings->provider === SsoSetting::PROVIDER_AZURE
    && !($settings->data instanceof SsoSettingsAzureDataDto)) {
    // re-save Azure settings via the UI before use
}

try {
    $settingsDto = $service->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    if (str_contains($e->getMessage(), 'Invalid provider data')) {
        // recreate Azure settings via administration UI
    }
    throw $e;
}

When it happens

Trigger: sso_settings row has provider=Azure but its data decodes to another provider's DTO — typically after manual DB edits, restores, or mismatched persisted drafts.

Common situations: Backup restores mixing settings; direct DB manipulation; plugin upgrade changing DTO classes while old data persisted.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• Invalid provider data. Expected AD FS settings.
• Invalid provider. Expected Azure as provider.
• No valid SSO settings found.
• Single sign-on failed. The
• Client ID should be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/545196f130b237e9. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/Azure/SsoAzureService.php:117

            'redirectUri' => Router::url('/sso/azure/redirect', true),
            'tenant' => $data->tenant_id,
            'openIdBaseUri' => $data->url ?? null,
            'emailClaim' => $data->email_claim ?? null,
        ]);
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_AZURE) {
                throw new BadRequestException('Invalid provider. Expected Azure as provider.');
            }
            if (!($ssoSettings->data instanceof SsoSettingsAzureDataDto)) {
                throw new BadRequestException('Invalid provider data. Expected Azure settings.');
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }

    // OVERRIDDEN METHODS

    /**
     * @inheritDoc
     */
    public function assertResourceOwnerAgainstSsoState(
        SsoResourceOwnerInterface $resourceOwner,
        SsoState $ssoState
    ): void {
        parent::assertResourceOwnerAgainstSsoState($resourceOwner, $ssoState);

View on GitHub (pinned to 31c1bbc10f)