passbolt/passbolt_api · error · CustomValidationException

Something went wrong when validating the single-sign on…

Error message

Something went wrong when validating the single-sign on settings.

What it means

After the admin check, create() builds the SSO settings form (getSsoSettingsForm based on the chosen provider) and executes it; on failure it throws CustomValidationException with the message 'Something went wrong when validating the single-sign on settings.' and attaches $form->getErrors() as the error details. It means the submitted data did not pass the form/schema rules for the provider.

Solutions

1. Inspect the errors object attached to the exception (form->getErrors()) to see exactly which fields failed.
2. Fix the offending fields per the provider schema (client id, client secret, tenant id, redirect/urls, etc.).
3. Use the correct provider value (e.g. 'azure' vs 'google') so the right form is selected.
4. Compare your payload against the plugin's form validation class (SsoSettingsFormDataForm / provider-specific forms) for the accepted field list.

Example fix

// before
$data = ['provider' => 'azure', 'client_id' => 'abc']; // missing required fields
$service->create($uac, $data);
// after
$data = ['provider' => 'azure', 'client_id' => 'abc', 'client_secret' => 'xyz', 'tenant_id' => '...', 'url' => 'https://login.microsoftonline.com'];
$service->create($uac, $data);

// pre-validate key fields per provider before calling
$required = ['provider', 'client_id', 'client_secret', 'tenant_id', 'url'];
$missing = array_diff($required, array_keys(array_filter($data)));
if ($missing) { throw new Exception('Missing: ' . implode(',', $missing)); }

try { $service->create($uac, $data); } catch (CustomValidationException $e) { $errors = $e->getErrors(); // show field-level errors to the user }

When it happens

Trigger: Posting SSO settings missing required provider fields (e.g. azure_ad client id/secret/tenant), invalid URLs, unsupported provider value, wrong data types for fields like url or scopes.

Common situations: Copying settings from another provider into the wrong schema; typos in field names; leaving secret/id fields empty; using HTTP instead of HTTPS URLs where required; upgrading providers where the form schema changed.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• Could not save the SSO state, invalid nonce.
• Could not validate the SSO recover request.
• Invalid status.
• Service provider missing.
• Service provider not supported.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7f080245407885f7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsSetService.php:54

class SsoSettingsSetService
{
    /**
     * Create an encrypted org setting
     *
     * @param \App\Utility\UserAccessControl $uac user access control
     * @param array $data user provided data
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    public function create(UserAccessControl $uac, array $data): SsoSettingsDto
    {
        if (!$uac->isAdmin()) {
            throw new BadRequestException(__('Only administrators can create SSO settings.'));
        }

        $form = $this->getSsoSettingsForm($data);
        if (!$form->execute($data)) {
            throw new CustomValidationException(
                __('Something went wrong when validating the single-sign on settings.'),
                $form->getErrors()
            );
        }
        $data = $form->getData();

        // Prepare the data, serialize the JSON and encrypt using server key
        $serializedData = $this->serializeData($data['provider'], $data['data']);
        $encryptedData = $this->encrypt($serializedData);

        // Build entity
        $ssoSettingsTable = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoSettings');
        /** @var \Passbolt\Sso\Model\Entity\SsoSetting $ssoSettingEntity */
        $ssoSettingEntity = $ssoSettingsTable->newEntity(
            [
                'provider' => $data['provider'],
                'status' => SsoSetting::STATUS_DRAFT,
                'data' => $encryptedData,

View on GitHub (pinned to 31c1bbc10f)