passbolt/passbolt_api · error · BadRequestException

No valid SSO settings found.

Error message

No valid SSO settings found.

What it means

This is the catch-all in SsoGoogleService::assertAndGetSsoSettings: any exception during retrieval/validation of the active SSO settings (including RecordNotFoundException from getActiveOrFail and the provider/data BadRequestExceptions thrown inside the try) is rethrown as BadRequestException 'No valid SSO settings found.' with the original as previous.

Solutions

1. Verify SSO settings exist and are ACTIVE (not draft/deleted) via the admin SSO settings screen or SsoSettingsGetService
2. If Google SSO is intended, complete the settings setup/salvage flow so an active Google configuration exists
3. If another provider is configured, call that provider's SSO endpoint instead of Google's
4. Check the chained previous exception (3rd constructor arg) in logs to see whether it was not-found vs provider/data mismatch

try {
    $settings = (new SsoSettingsGetService())->getActiveOrFail(true);
    $hasValidGoogle = $settings->provider === SsoSetting::PROVIDER_GOOGLE
        && $settings->data instanceof SsoSettingsGoogleDataDto;
} catch (RecordNotFoundException $e) {
    $hasValidGoogle = false;
}

try {
    $settings = $googleService->assertAndGetSsoSettings();
} catch (BadRequestException $e) {
    $previous = $e->getPrevious();
    // RecordNotFoundException => configure SSO; else provider/data mismatch
}

When it happens

Trigger: No SSO settings exist or none are active (getActiveOrFail throws); the settings are disabled/draft; or one of the provider/data checks above failed and got wrapped by this catch block.

Common situations: Fresh instance where SSO was never configured; SSO settings deleted or deactivated; admin saved settings but they remain in draft status; user attempting SSO login after admin removed the provider; settings saved for a different provider than the Google endpoint being hit.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• Invalid provider. Expected Google as provider.
• No valid SSO settings found.
• No valid SSO settings found.
• No valid SSO settings found.
• No valid SSO settings found.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/58f7eeb63bd52c09. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/Google/SsoGoogleService.php:91

            'redirectUri' => Router::url('/sso/google/redirect', true),
        ]);
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_GOOGLE) {
                throw new BadRequestException('Invalid provider. Expected Google as provider.');
            }
            if (!($ssoSettings->data instanceof SsoSettingsGoogleDataDto)) {
                throw new BadRequestException('Invalid provider data. Expected Google settings.');
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }

    // HELPERS
}

View on GitHub (pinned to 31c1bbc10f)