passbolt/passbolt_api · error · BadRequestException

No valid SSO settings found.

Error message

No valid SSO settings found.

What it means

Azure's assertAndGetSsoSettings wraps getActiveOrFail and provider/data checks in a try/catch; any Exception (no active settings, or the provider/data assertion failures) is converted into BadRequestException 'No valid SSO settings found.' with the original exception chained.

Solutions

1. Configure and fully activate Azure SSO settings in passbolt administration.
2. Use the dry-run flow to validate settings before activation.
3. Check logs/chained exception for the underlying cause (missing settings vs wrong provider).
4. Verify active sso_settings rows exist for your organization id.

Example fix

// before
Azure settings saved as draft only, then login attempted
// after
POST /sso/settings/:id/activate (activate the draft) then retry SSO login

try {
    (new SsoSettingsGetService())->getActiveOrFail();
} catch (RecordNotFoundException $e) {
    // no active settings: run the SSO setup wizard first
}

try {
    $uac = $service->assertStateCodeAndGetUac(...);
} catch (BadRequestException $e) {
    if (str_contains($e->getMessage(), 'No valid SSO settings found')) {
        // inspect $e->getPrevious() and activate Azure settings
    }
    throw $e;
}

When it happens

Trigger: No activated Azure SSO settings exist, an SSO operation runs with only a draft, or the inner Azure provider/data assertions throw.

Common situations: Settings never activated; database reset removing sso_settings rows; wrong organization id; settings deleted mid-flow by another admin.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• Invalid provider data. Expected Azure settings.
• Invalid provider. Expected Azure as provider.
• No valid SSO settings found.
• No valid SSO settings found.
• No valid SSO settings found.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/3c398ecfa69dfa93. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/Azure/SsoAzureService.php:120

            'emailClaim' => $data->email_claim ?? null,
        ]);
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_AZURE) {
                throw new BadRequestException('Invalid provider. Expected Azure as provider.');
            }
            if (!($ssoSettings->data instanceof SsoSettingsAzureDataDto)) {
                throw new BadRequestException('Invalid provider data. Expected Azure settings.');
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }

    // OVERRIDDEN METHODS

    /**
     * @inheritDoc
     */
    public function assertResourceOwnerAgainstSsoState(
        SsoResourceOwnerInterface $resourceOwner,
        SsoState $ssoState
    ): void {
        parent::assertResourceOwnerAgainstSsoState($resourceOwner, $ssoState);

        /** @var \Passbolt\Sso\Utility\Azure\ResourceOwner\AzureResourceOwner $resourceOwner */
        $this->assertAuthTime($resourceOwner->getAuthTime(), $ssoState->created->getTimestamp());

View on GitHub (pinned to 31c1bbc10f)