fix: graceful handling when user_saml is enabled but no IdP is configured

[printminion-co]

Summary

• Fixes a 500 TypeError that occurs when user_saml is active (type=saml) but no IdP has been configured
• Redirects to the existing genericError page with a translatable user-readable message instead of crashing
• Adds occ saml:config:validate for one-shot admin/support diagnostics (exit 0/1/2)

Reproduction

1. Install/enable the user_saml app
2. occ config:app:set user_saml type --value saml
3. Do not add any IdP via the admin panel
4. Open the Nextcloud login page → 500 TypeError

Root Cause

The crash is a two-step interaction within the same request:

1. Application.php beforeware calls $samlSettings->getListOfIdps() → ensureConfigurationsLoaded(-1) loads from DB → DB is empty → sets configurationsLoadedState = LOADED_ALL
2. SAMLController::login(1) calls getOneLoginSettingsArray(1) → ensureConfigurationsLoaded(1) returns early (already LOADED_ALL) → $this->configurations[1] is never set → remains null
3. Line 156 calls array_key_exists('sp-entityId', $this->configurations[$idp]) — array_key_exists() on null throws a TypeError

Every other field access in getOneLoginSettingsArray() uses the safe ?? '' null-coalesce pattern; line 156 was the one outlier using array_key_exists().

Changes

lib/SAMLSettings.php

• Replace the array_key_exists() call with ?? '' (consistent with all other lines in the method)
• Add an early guard after ensureConfigurationsLoaded() that throws InvalidArgumentException when the requested IdP is absent from $configurations, converting a cryptic null-pointer into a clear, actionable message

lib/Controller/SAMLController.php

• Catch InvalidArgumentException from getOneLoginSettingsArray() in login() and redirect to the existing genericError page with a translatable user-readable message, instead of letting the exception propagate as a 500

occ saml:config:validate (new command)

Gives support teams and administrators a single command to diagnose the SAML configuration state without reading raw database rows:

$ occ saml:config:validate
Type: saml
  IdP #1 (My IdP): MISSING idp-entityId, idp-singleSignOnService.url

Exit codes:

Code	Meaning
0	All configured IdPs pass required-field validation
1	type not set — app is not active
2	Active but one or more required fields are missing

Validated fields per IdP: idp-entityId, idp-singleSignOnService.url, general-uid_mapping.

New files: lib/Command/ConfigValidate.php, tests/unit/Command/ConfigValidateTest.php, + one line in appinfo/info.xml.

Tests

• tests/unit/SAMLSettingsTest.php (new): reproduces the exact LOADED_ALL bug scenario; also covers the simple not-in-DB case, happy path, and sp-entityId fallback to metadata URL
• tests/unit/Controller/SAMLControllerTest.php: adds testLoginWithUnconfiguredIdpRedirectsToGenericError() — verifies the controller redirects to genericError when getOneLoginSettingsArray() throws InvalidArgumentException
• tests/unit/Command/ConfigValidateTest.php (new): covers all four exit-code paths (type not set, no IdPs, OK, missing fields)

After This Fix

• /login — shows the normal Nextcloud login page (no crash; admins can still log in to fix the configuration)
• /apps/user_saml/saml/login?idp=1 — redirects to the existing genericError page with a readable message: "SAML authentication is not configured. Please ask your administrator to complete the SAML setup in the admin panel."
• data/nextcloud.log — no array_key_exists(): Argument #2 must be of type array, null given

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)