passbolt/passbolt_api · error · BadRequestException

Invalid provider. Expected PingOne.

Error message

Invalid provider. Expected PingOne.

What it means

Consistency guard in the SSO PingOne service: the active SSO settings DTO being processed names a provider other than pingone, so the settings do not belong to this service and further PingONE operations are refused.

Solutions

1. Verify active SSO settings have provider 'pingone' via admin settings or SsoSettingsGetService
2. Call the SSO endpoint/service corresponding to the actually configured provider
3. Re-save PingOne settings and clear cached settings if provider changed recently
4. Remove stale pending SSO state on clients after provider switches

$settings = (new SsoSettingsGetService())->getActiveOrFail(true);
if ($settings->provider !== SsoSetting::PROVIDER_PINGONE) {
    // use the service matching $settings->provider
}

if (!$ssoSettings instanceof SsoSettingsDto || $ssoSettings->provider !== SsoSetting::PROVIDER_PINGONE) {
    return null;
}

try {
    $settings = $pingOneService->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    // fall back to the configured provider's SSO service
}

When it happens

Trigger: SSO request routed to the PingOne service while active settings specify google, azure, or oauth2; provider switched away from PingOne after a client started the SSO flow.

Common situations: Admin replaced PingOne with another provider while users had pending SSO state; wrong provider endpoint invoked; manually edited sso_settings.provider value; settings cache stale after provider change.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Invalid provider. Expected Google as provider.
• Invalid provider. Expected OAuth2.
• No valid SSO settings found.
• The SSO settings do not exist.
• $data['error'] (dynamic provider error)

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/a956a1129a5e80db. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/PingOne/SsoPingOneService.php:66

                'redirectUri' => Router::url('/sso/pingone/redirect', true),
                'openIdBaseUri' => $data->url,
                'openIdConfigurationPath' => $data->openid_configuration_path,
                'environmentId' => $data->environment_id,
                'emailClaim' => $data->email_claim,
            ],
            ['httpClient' => $this->getCustomHttpClient()]
        );
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_PINGONE) {
                throw new BadRequestException(__('Invalid provider. Expected PingOne.'));
            }
            if (!($ssoSettings->data instanceof SsoSettingsPingOneDataDto)) {
                throw new BadRequestException(__('Invalid provider data. Expected PingOne settings.'));
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }
}

View on GitHub (pinned to 31c1bbc10f)