What causes "Invalid provider. Expected OAuth2." in passbolt/passbolt_api?

Confirm the active SSO settings provider is 'oauth2' via the admin settings or SsoSettingsGetService

passbolt/passbolt_api · error · BadRequestException

Invalid provider. Expected OAuth2.

Error message

Invalid provider. Expected OAuth2.

What it means

Thrown by the OAuth2 SsoOAuth2Service::assertAndGetSsoSettings when the active SSO settings provider is not PROVIDER_OAUTH2. The generic OAuth2 service only accepts settings whose provider is oauth2 before starting the SSO flow.

Solutions

Confirm the active SSO settings provider is 'oauth2' via the admin settings or SsoSettingsGetService
Use the SSO service/endpoint matching the actually configured provider (Google, PingOne, Azure)
Re-save OAuth2 settings and clear any cached settings if the provider was recently changed
Search client-side for hardcoded OAuth2 provider references that should be dynamic

Defensive patterns

Strategy: try-catch

Validate before calling

$settings = (new SsoSettingsGetService())->getActiveOrFail(true);
if ($settings->provider !== SsoSetting::PROVIDER_OAUTH2) {
    // dispatch to the service matching $settings->provider
}

Type guard

if (!$ssoSettings instanceof SsoSettingsDto || $ssoSettings->provider !== SsoSetting::PROVIDER_OAUTH2) {
    return null;
}

Try / catch

try {
    $settings = $oauth2Service->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    // route to the configured provider's service instead
}

Prevention

Resolve the SSO service from the active settings provider rather than hardcoding OAuth2
Invalidate cached settings whenever the provider changes
Confirm provider value in admin SSO settings before running OAuth2 flows

When it happens

Trigger: An SSO request routed to the OAuth2 service while active settings have provider google, azure, or pingone; or the settings were switched away from OAuth2 between generating the SSO link and the callback.

Common situations: Admin migrated from generic OAuth2 to a first-class provider (Google/PingOne) leaving stale client state; wrong SSO endpoint called for the configured provider; database row edited manually changing provider value.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/8e459d3fd4dbc52f. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/OAuth2/SsoOAuth2Service.php:102

                'clientId' => $data->client_id,
                'clientSecret' => $data->client_secret,
                'redirectUri' => Router::url('/sso/oauth2/redirect', true),
                'openIdBaseUri' => $data->url,
                'openIdConfigurationPath' => $data->openid_configuration_path,
            ],
            ['httpClient' => $this->getCustomHttpClient()]
        );
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_OAUTH2) {
                throw new BadRequestException('Invalid provider. Expected OAuth2.');
            }
            if (!($ssoSettings->data instanceof SsoSettingsOAuth2DataDto)) {
                throw new BadRequestException('Invalid provider data. Expected OAuth2 settings.');
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }
}

View on GitHub (pinned to 31c1bbc10f)