{"record":{"id":"08bca3474851e213","repo":"passbolt/passbolt_api","slug":"the-sso-settings-do-not-exist-azurerecoverlogincontroller","errorCode":null,"errorMessage":"The SSO settings do not exist.","messagePattern":"The SSO settings do not exist\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Controller/Azure/AzureRecoverLoginController.php","lineNumber":54,"sourceCode":"    public function beforeFilter(EventInterface $event)\n    {\n        parent::beforeFilter($event);\n\n        $this->Authentication->allowUnauthenticated(['login']);\n    }\n\n    /**\n     * Return a URL to redirect the user to perform SSO (without hint)\n     *\n     * @param \\App\\Service\\Cookie\\AbstractSecureCookieService $cookieService Cookie service\n     * @return void\n     */\n    public function login(AbstractSecureCookieService $cookieService): void\n    {\n        try {\n            (new SsoSettingsGetService())->getActiveOrFail();\n        } catch (RecordNotFoundException $e) {\n            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);\n        }\n\n        $this->User->assertNotLoggedIn();\n\n        $uac = new ExtendedUserAccessControl(\n            Role::GUEST,\n            null,\n            null,\n            $this->User->ip(),\n            $this->User->userAgent()\n        );\n\n        $url = $this->getSsoUrlWithCookie(new SsoAzureService($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);\n\n        $this->success(__('The operation was successful.'), $url->jsonSerialize());\n    }\n}\n","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Controller/Azure/AzureRecoverLoginController.php#L36-L72","documentation":"Exactly like the ADFS variant (error 875) but for Azure AD: the Azure recover-login controller requires an active SSO configuration and throws BadRequestException when SsoSettingsGetService::getActiveOrFail() cannot find one.","triggerScenarios":"Hitting the Azure recover login URL (/sso/recover/login/azure) while there is no active SSO settings record, or the active record's provider is not Azure AD.","commonSituations":"Recovery emails sent while Azure SSO was active, then clicked after an admin disabled/deleted the settings; organization switched providers (e.g. to Google/ADFS) so the Azure-specific URL no longer resolves; unconfigured test environments.","solutions":["Re-activate the Azure AD SSO settings (admin UI or ./bin/cake passbolt sso_settings) if Azure SSO is intended","Fall back to the standard email-based recover flow when SSO is intentionally disabled","Confirm the active provider matches the URL used (azure vs adfs vs google)","Inspect the sso_settings table for an active row and its provider value"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"try {\n    $settings = (new \\Passbolt\\Sso\\Service\\SsoSettingsGetService())->getActiveOrFail();\n    if ($settings->provider !== 'azure') {\n        // use the URL matching the active provider instead\n    }\n} catch (\\Cake\\Datasource\\Exception\\RecordNotFoundException $e) {\n    // SSO inactive: fall back to standard recover\n}","typeGuard":null,"tryCatchPattern":"try {\n    return $this->redirect($azureRecoverLoginUrl);\n} catch (\\Cake\\Http\\Exception\\BadRequestException $e) {\n    if ($e->getMessage() === 'The SSO settings do not exist.') {\n        return $this->redirect('/recover');\n    }\n    throw $e;\n}","preventionTips":["Verify the active SSO provider before using provider-specific recover URLs","Re-issue recovery emails after any SSO settings change","Keep test environments configured with the SSO settings they are exercised against","Confirm sso_settings has an active row with provider 'azure' before running Azure recover tests"],"tags":["sso","recover","azure","missing-settings"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}