What causes "Invalid provider. Expected AD FS." in passbolt/passbolt_api?

Open SSO settings in passbolt administration and confirm the active provider is AD FS; reconfigure and activate AD FS settings if not.

passbolt/passbolt_api · error · BadRequestException

Invalid provider. Expected AD FS.

Error message

Invalid provider. Expected AD FS.

What it means

The AD FS SSO service asserts that the active SSO settings on the server are for the AD FS provider before building its OAuth2 client. If the active settings have a different provider value, a BadRequestException is thrown. This is a configuration guard ensuring the correct service handles the request.

Solutions

Open SSO settings in passbolt administration and confirm the active provider is AD FS; reconfigure and activate AD FS settings if not.
Use the correct provider endpoint/route matching the active settings (e.g. Azure routes for Azure settings).
If a draft is stuck, delete/discard the draft settings and create a new AD FS settings draft.
Verify sso_settings table row (provider column) matches the intended provider after restores or migrations.

Example fix

// before
$ssoSettings->provider === 'azure' but calling SsoAdfsService
// after
activate AD FS settings so $ssoSettings->provider === SsoSetting::PROVIDER_ADFS

Defensive patterns

Strategy: try-catch

Validate before calling

$settings = (new SsoSettingsGetService())->get();
if ($settings->isActive() && $settings->provider !== SsoSetting::PROVIDER_ADFS) {
    // use the service matching $settings->provider instead of SsoAdfsService
}

Try / catch

try {
    $settingsDto = $service->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    if (str_contains($e->getMessage(), 'Invalid provider')) {
        // reconfigure or route to the correct provider service
    }
    throw $e;
}

Prevention

Activate only one provider's settings and call that provider's endpoints/routes.
After switching providers, invalidate old bookmarks and client caches.
Check the provider value in sso_settings after DB restores.
Use dry-run to detect provider/settings mismatch early.

When it happens

Trigger: An AD FS SSO endpoint (auth/start, verify, dry-run) is hit while the active SSO settings stored in the database are for another provider (e.g. Azure or Google).

Common situations: Admin switched the SSO provider from Azure to AD FS (or vice versa) but old AD FS URLs/bookmarks or clients still call the AD FS route; the settings draft was saved for another provider; environment restores where sso_settings rows point to a different provider.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/5154d42e17c4727d. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/Adfs/SsoAdfsService.php:65

                'clientSecret' => $data->client_secret,
                'redirectUri' => Router::url('/sso/adfs/redirect', true),
                'openIdBaseUri' => $data->url,
                'openIdConfigurationPath' => $data->openid_configuration_path,
                'emailClaim' => $data->email_claim,
            ],
            ['httpClient' => $this->getCustomHttpClient()]
        );
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_ADFS) {
                throw new BadRequestException(__('Invalid provider. Expected AD FS.'));
            }
            if (!($ssoSettings->data instanceof SsoSettingsAdfsDataDto)) {
                throw new BadRequestException(__('Invalid provider data. Expected AD FS settings.'));
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }
}

View on GitHub (pinned to 31c1bbc10f)