passbolt/passbolt_api · error · BadRequestException

Invalid provider data. Expected OAuth2 settings.

Error message

Invalid provider data. Expected OAuth2 settings.

What it means

Thrown by SsoOAuth2Service::assertAndGetSsoSettings when provider is oauth2 but the settings `data` is not an instance of SsoSettingsOAuth2DataDto, meaning the stored payload does not contain valid OAuth2 settings fields (client id, tenant, endpoints, etc.).

Solutions

1. Re-save OAuth2 SSO settings through the admin UI/API so the data payload matches SsoSettingsOAuth2DataDto
2. Inspect the sso_settings data column for oauth2-specific keys (client_id, client_secret, tenant_id, etc.) and fix corrupt entries
3. Check DTO hydration logic in SsoSettingsGetService for provider-to-DTO mapping regressions after upgrades
4. Always update provider and its data together in a single settings submission

$settings = (new SsoSettingsGetService())->getActiveOrFail(true);
if (!($settings->data instanceof SsoSettingsOAuth2DataDto)) {
    throw new BadRequestException(__('OAuth2 settings data is invalid; re-save the settings.'));
}

if (!($ssoSettings->data instanceof SsoSettingsOAuth2DataDto)) {
    return null;
}

try {
    $settings = $oauth2Service->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    // ask admin to re-save OAuth2 settings to rebuild the data payload
}

When it happens

Trigger: sso_settings row has provider='oauth2' while its data deserializes to another provider's DTO (e.g. Google or PingOne data), from a mismatched update where provider and data were changed inconsistently, or legacy/failed migration data.

Common situations: Partial provider migration where only the provider string was updated; manual database edits; restore of settings dump combining incompatible provider/data pairs; bug in settings save path writing wrong DTO for oauth2.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• AccessToken should be an instance of BaseIdToken class.
• Invalid provider data. Expected Google settings.
• Invalid provider data. Expected PingOne settings.
• Cannot parse JWKS endpoint response.
• $data['error'] (dynamic provider error)

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/13d480c124a3edb3. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/OAuth2/SsoOAuth2Service.php:105

                'openIdBaseUri' => $data->url,
                'openIdConfigurationPath' => $data->openid_configuration_path,
            ],
            ['httpClient' => $this->getCustomHttpClient()]
        );
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_OAUTH2) {
                throw new BadRequestException('Invalid provider. Expected OAuth2.');
            }
            if (!($ssoSettings->data instanceof SsoSettingsOAuth2DataDto)) {
                throw new BadRequestException('Invalid provider data. Expected OAuth2 settings.');
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }
}

View on GitHub (pinned to 31c1bbc10f)