passbolt/passbolt_api · error · BadRequestException

Invalid provider data. Expected PingOne settings.

Error message

Invalid provider data. Expected PingOne settings.

What it means

Thrown by SsoPingOneService::assertAndGetSsoSettings when provider is pingone but settings `data` is not a SsoSettingsPingOneDataDto, i.e. the stored payload lacks valid PingOne fields (environment id, client id/secret, etc.).

Solutions

1. Re-save PingOne SSO settings via the admin UI/API to rebuild the data payload as PingOne settings
2. Inspect the sso_settings data column for PingOne keys (environment_id, client_id, client_secret) and repair corrupt rows
3. Check provider-to-DTO mapping in the settings hydration service after version upgrades
4. Change provider and data payload together in one settings update

$settings = (new SsoSettingsGetService())->getActiveOrFail(true);
if (!($settings->data instanceof SsoSettingsPingOneDataDto)) {
    throw new BadRequestException(__('PingOne settings data is invalid; re-save the settings.'));
}

if (!($ssoSettings->data instanceof SsoSettingsPingOneDataDto)) {
    return null;
}

try {
    $settings = $pingOneService->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    // prompt re-save of PingOne settings to rebuild the payload
}

When it happens

Trigger: sso_settings provider='pingone' whose data hydrates to a different provider's DTO, caused by inconsistent updates changing provider without the matching data, corrupt entries, or legacy data not mapping to the PingOne DTO.

Common situations: Partial migration where only the provider field was changed; database restore combining mismatched provider/data; manual row edit; upgrade changed DTO hydration and old payloads no longer instantiate SsoSettingsPingOneDataDto.

Understand the failure class

Background: Type mismatch errors: IllegalArgumentException, TypeError and type guards across 150 open-source libraries — this error's family across 150 libraries.

Related errors

• Invalid provider data. Expected Google settings.
• Invalid provider data. Expected OAuth2 settings.
• AccessToken should be an instance of BaseIdToken class.
• $data['error'] (dynamic provider error)
• Invalid provider. Expected PingOne.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/478f5b278aadfeaa. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/PingOne/SsoPingOneService.php:69

                'environmentId' => $data->environment_id,
                'emailClaim' => $data->email_claim,
            ],
            ['httpClient' => $this->getCustomHttpClient()]
        );
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_PINGONE) {
                throw new BadRequestException(__('Invalid provider. Expected PingOne.'));
            }
            if (!($ssoSettings->data instanceof SsoSettingsPingOneDataDto)) {
                throw new BadRequestException(__('Invalid provider data. Expected PingOne settings.'));
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }
}

View on GitHub (pinned to 31c1bbc10f)