{"record":{"id":"081012f19b2b3657","repo":"passbolt/passbolt_api","slug":"only-administrators-can-create-sso-settings","errorCode":null,"errorMessage":"Only administrators can create SSO settings.","messagePattern":"Only administrators can create SSO settings\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsSetService.php","lineNumber":49,"sourceCode":"use Passbolt\\Sso\\Form\\SsoSettingsGoogleDataForm;\nuse Passbolt\\Sso\\Form\\SsoSettingsOAuth2DataForm;\nuse Passbolt\\Sso\\Form\\SsoSettingsPingOneDataForm;\nuse Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto;\nuse Passbolt\\Sso\\Model\\Entity\\SsoSetting;\n\nclass SsoSettingsSetService\n{\n    /**\n     * Create an encrypted org setting\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac user access control\n     * @param array $data user provided data\n     * @return \\Passbolt\\Sso\\Model\\Dto\\SsoSettingsDto\n     */\n    public function create(UserAccessControl $uac, array $data): SsoSettingsDto\n    {\n        if (!$uac->isAdmin()) {\n            throw new BadRequestException(__('Only administrators can create SSO settings.'));\n        }\n\n        $form = $this->getSsoSettingsForm($data);\n        if (!$form->execute($data)) {\n            throw new CustomValidationException(\n                __('Something went wrong when validating the single-sign on settings.'),\n                $form->getErrors()\n            );\n        }\n        $data = $form->getData();\n\n        // Prepare the data, serialize the JSON and encrypt using server key\n        $serializedData = $this->serializeData($data['provider'], $data['data']);\n        $encryptedData = $this->encrypt($serializedData);\n\n        // Build entity\n        $ssoSettingsTable = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoSettings');\n        /** @var \\Passbolt\\Sso\\Model\\Entity\\SsoSetting $ssoSettingEntity */","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsSetService.php#L31-L67","documentation":"SsoSettingsSetService::create() requires the acting user (via UserAccessControl) to be an administrator. If $uac->isAdmin() is false it throws BadRequestException 'Only administrators can create SSO settings.' This enforces that only admins may define SSO configuration.","triggerScenarios":"A non-admin (logged-in user, or service/UAC built from a non-admin role) calls the create SSO settings service or the POST /sso/settings endpoint.","commonSituations":"Integrations calling the API with a regular user token; CLI jobs constructing UserAccessControl with role 'user'; testing with a non-admin account.","solutions":["Perform the operation as, or with a UserAccessControl for, a user with role 'admin'.","Check the authenticated user's role; promote if legitimately intended (users table role_id).","In CLI/automation code, build UAC from an admin user (e.g. new UserAccessControl('admin', $adminId)).","Ensure the API client is using admin credentials, not a standard user's."],"exampleFix":"// before\n$uac = new UserAccessControl($user['role']['name'], $user['id']); // 'user'\n$service->create($uac, $data);\n// after\nif (!$uac->isAdmin()) {\n    throw new ForbiddenException(__('Only administrators can create SSO settings.'));\n}\n$service->create($uac, $data);","handlingStrategy":"validation","validationCode":"if (!$uac->isAdmin()) { throw new ForbiddenException(__('Administrator role required')); }","typeGuard":"$isAdmin = $uac->isAdmin();","tryCatchPattern":"try { $service->create($uac, $data); } catch (BadRequestException $e) { if (str_contains($e->getMessage(), 'administrators')) { // escalate or reject } }","preventionTips":["Verify the acting user's role is admin before calling admin-only services","In CLI code, build UserAccessControl from an admin user","Use admin credentials for integration clients touching SSO settings"],"tags":["sso","authorization","permissions","admin"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}