passbolt/passbolt_api · error · BadRequestException

No valid SSO settings found.

Error message

No valid SSO settings found.

What it means

assertAndGetSsoSettings wraps SsoSettingsGetService::getActiveOrFail(true) and the provider/data checks in a try/catch. Any Exception (no active settings found, draft-only state, or the provider/data assertion failures above) is converted into a single BadRequestException 'No valid SSO settings found.' with the original exception chained.

Solutions

1. Configure and activate SSO settings in passbolt administration (complete the full flow, not just a draft).
2. Use the dry-run flow to validate settings before activation.
3. Check the chained exception in the response/logs for the underlying cause (no settings vs invalid provider).
4. Verify sso_settings rows exist and are active for your organization id in the database.

Example fix

// before
POST /sso/settings only saved as draft, then login attempted
// after
POST /sso/settings/:id/activate (activate the draft) then retry SSO login

$active = (new SsoSettingsGetService())->getActiveOrFail();
if (!$active) {
    // configure and activate SSO settings before attempting SSO
}

try {
    $uac = $service->assertStateCodeAndGetUac(...);
} catch (BadRequestException $e) {
    if (str_contains($e->getMessage(), 'No valid SSO settings found')) {
        // check $e->getPrevious() for the root cause (missing vs invalid settings)
    }
    throw $e;
}

When it happens

Trigger: No activated SSO settings exist in the database, or an SSO operation is attempted while only a draft exists, or the inner provider/data assertions threw.

Common situations: SSO settings were created but never activated; database was reset/restored losing the sso_settings rows; wrong org id or missing settings for the environment; settings deleted by another admin mid-flow.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• Invalid provider data. Expected AD FS settings.
• Invalid provider. Expected AD FS.
• No valid SSO settings found.
• No valid SSO settings found.
• No valid SSO settings found.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/b78f72517c433921. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/Sso/Adfs/SsoAdfsService.php:71

            ['httpClient' => $this->getCustomHttpClient()]
        );
    }

    /**
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    protected function assertAndGetSsoSettings(): SsoSettingsDto
    {
        try {
            $ssoSettings = (new SsoSettingsGetService())->getActiveOrFail(true);
            if ($ssoSettings->provider !== SsoSetting::PROVIDER_ADFS) {
                throw new BadRequestException(__('Invalid provider. Expected AD FS.'));
            }
            if (!($ssoSettings->data instanceof SsoSettingsAdfsDataDto)) {
                throw new BadRequestException(__('Invalid provider data. Expected AD FS settings.'));
            }
        } catch (Exception $exception) {
            throw new BadRequestException(__('No valid SSO settings found.'), 400, $exception);
        }

        return $ssoSettings;
    }
}

View on GitHub (pinned to 31c1bbc10f)