passbolt/passbolt_api · error · BadRequestException

Invalid provider. Expected Google as provider.

Error message

Invalid provider. Expected Google as provider.

What it means

This error is thrown by SsoGoogleService::assertAndGetSsoSettings when the active SSO settings stored in the database have a provider that is not 'google'. The Google SSO service only processes authentication requests when Google is the configured provider, so it validates the active settings before use.

Solutions

1. Check the active SSO settings (admin UI or `SsoSettingsGetService->getActiveOrFail()`) and confirm the provider is set to Google
2. If another provider is intended, use the corresponding SSO service/endpoint for that provider instead of the Google one
3. Re-save the Google SSO settings to refresh the active settings if a stale/corrupted entry is active
4. Clear the SSO settings cache after changing providers so requests pick up the new active configuration

$settings = (new SsoSettingsGetService())->getActiveOrFail(true);
if ($settings->provider !== SsoSetting::PROVIDER_GOOGLE) {
    // route to the correct provider service instead of Google's
}

if (!$ssoSettings instanceof SsoSettingsDto || $ssoSettings->provider !== SsoSetting::PROVIDER_GOOGLE) {
    return null;
}

try {
    $settings = $googleService->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    // inspect $e->getPrevious() and fall back to the matching provider service
}

When it happens

Trigger: An SSO flow routed to the Google service (e.g. SSO login/registration) while the active SSO settings in sso_settings have provider set to another value (azure, oauth2, pingone) or were changed after the request was generated.

Common situations: Admin switched the SSO provider from Google to another provider (e.g. during a migration to OAuth2/PingOne) while clients still had pending Google-based SSO state; stale settings cache serving outdated provider; misconfigured environment pointing at the wrong organization settings.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Invalid provider. Expected OAuth2.
• Invalid provider. Expected PingOne.
• No valid SSO settings found.
• The SSO settings do not exist.
• $data['error'] (dynamic provider error)

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/8a7785184c900182. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/Google/SsoGoogleService.php:85

        /** @var \Passbolt\Sso\Model\Dto\SsoSettingsGoogleDataDto $data */
        $data = $settings->data;

        return SsoProviderFactory::create(GoogleProvider::class, [
            'clientId' => $data->client_id,
            'clientSecret' => $data->client_secret,
            'redirectUri' => Router::url('/sso/google/redirect', true),
        ]);
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_GOOGLE) {
                throw new BadRequestException('Invalid provider. Expected Google as provider.');
            }
            if (!($ssoSettings->data instanceof SsoSettingsGoogleDataDto)) {
                throw new BadRequestException('Invalid provider data. Expected Google settings.');
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }

    // HELPERS
}

View on GitHub (pinned to 31c1bbc10f)