passbolt/passbolt_api · error · BadRequestException

Service provider not supported.

Error message

Service provider not supported.

What it means

Thrown by SsoSettingsSetService::getSsoSettingsForm when 'provider' is a string but is not in SsoSetting::ALLOWED_PROVIDERS. Only known providers (azure, google, adfs, oauth2, pingone) can be configured.

Solutions

1. Use one of the exact allowed provider identifiers (azure, google, adfs, oauth2, pingone) — all lowercase.
2. If your IdP is generic SAML/OIDC, use the appropriate supported mapping or upgrade passbolt to a version supporting it.
3. Check SsoSetting::ALLOWED_PROVIDERS in this codebase to confirm valid values for your installed version.

Example fix

// before
"provider": "Okta"
// after
"provider": "azure"

const ALLOWED = ['azure','google','adfs','oauth2','pingone']; if (!in_array($payload['provider'], ALLOWED, true)) { throw new \InvalidArgumentException('Unsupported provider'); }

When it happens

Trigger: POST/PUT /sso/settings with provider set to an unrecognized string, e.g. {"provider": "okta"}, {"provider": "Azure"} (case-sensitive), or a typo like "azrue".

Common situations: Trying to configure an unsupported IdP (Okta, Auth0, Keycloak directly); capitalization mistakes; older/newer passbolt versions where the provider list differs; typos in scripts.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• Service provider missing.
• Could not save the SSO state, invalid nonce.
• Could not validate the SSO recover request.
• Invalid status.
• Service provider invalid.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/68c41b97cb714815. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsSetService.php:157

        }

        return $gpg->encrypt($jsonData, true);
    }

    /**
     * @param array $data payload
     * @return \Passbolt\Sso\Form\BaseSsoSettingsForm
     */
    protected function getSsoSettingsForm(array $data): BaseSsoSettingsForm
    {
        if (!isset($data['provider'])) {
            throw new BadRequestException('Service provider missing.');
        }
        if (!is_string($data['provider'])) {
            throw new BadRequestException('Service provider invalid.');
        }
        if (!in_array($data['provider'], SsoSetting::ALLOWED_PROVIDERS)) {
            throw new BadRequestException('Service provider not supported.');
        }

        switch ($data['provider']) {
            case SsoSetting::PROVIDER_AZURE:
                return new SsoSettingsAzureDataForm();
            case SsoSetting::PROVIDER_GOOGLE:
                return new SsoSettingsGoogleDataForm();
            case SsoSetting::PROVIDER_OAUTH2:
                return new SsoSettingsOAuth2DataForm();
            case SsoSetting::PROVIDER_ADFS:
                return new SsoSettingsAdfsDataForm();
            case SsoSetting::PROVIDER_PINGONE:
                return new SsoSettingsPingOneDataForm();
            default:
                throw new BadRequestException('Service provider not supported.');
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)