passbolt/passbolt_api · error · BadRequestException

Invalid provider. Expected Azure as provider.

Error message

Invalid provider. Expected Azure as provider.

What it means

The Azure SSO service asserts that the active SSO settings are for the Azure provider before constructing its OAuth2 client. If the active settings' provider is not Azure, a BadRequestException is thrown. This guard ensures the Azure service only processes Azure settings.

Solutions

1. Activate Azure SSO settings in passbolt administration if Azure is the intended provider.
2. Call the endpoint matching the active provider's routes.
3. Discard mismatched draft settings and create a new Azure settings draft.
4. Verify the provider column in sso_settings matches 'azure'.

Example fix

// before
$ssoSettings->provider === 'adfs' but calling SsoAzureService
// after
activate Azure settings so $ssoSettings->provider === SsoSetting::PROVIDER_AZURE

$settings = (new SsoSettingsGetService())->get();
if ($settings->isActive() && $settings->provider !== SsoSetting::PROVIDER_AZURE) {
    // route to the service matching $settings->provider
}

try {
    $settingsDto = $service->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    if (str_contains($e->getMessage(), 'Invalid provider')) {
        // activate Azure settings or use the correct provider endpoint
    }
    throw $e;
}

When it happens

Trigger: An Azure SSO endpoint is reached while the active settings provider is something else (e.g. AD FS or Google), e.g. stale Azure URLs or clients after the admin switched providers.

Common situations: Provider switched from Azure to AD FS but browser bookmarks or the extension still call Azure routes; draft saved for a different provider; DB restores with wrong provider rows.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Invalid provider data. Expected Azure settings.
• No valid SSO settings found.
• Single sign-on failed. The
• Client ID should be a valid UUID.
• Failed to public key properties from certificate

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/c5b0fa487459801f. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/Azure/SsoAzureService.php:114

        return SsoProviderFactory::create(AzureProvider::class, [
            'clientId' => $data->client_id,
            'clientSecret' => $data->client_secret,
            'redirectUri' => Router::url('/sso/azure/redirect', true),
            'tenant' => $data->tenant_id,
            'openIdBaseUri' => $data->url ?? null,
            'emailClaim' => $data->email_claim ?? null,
        ]);
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_AZURE) {
                throw new BadRequestException('Invalid provider. Expected Azure as provider.');
            }
            if (!($ssoSettings->data instanceof SsoSettingsAzureDataDto)) {
                throw new BadRequestException('Invalid provider data. Expected Azure settings.');
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }

    // OVERRIDDEN METHODS

    /**
     * @inheritDoc
     */
    public function assertResourceOwnerAgainstSsoState(
        SsoResourceOwnerInterface $resourceOwner,

View on GitHub (pinned to 31c1bbc10f)