{"record":{"id":"0c02d75409d3d1c7","repo":"passbolt/passbolt_api","slug":"you-are-not-authorized-to-access-that-location-0c02d7","errorCode":null,"errorMessage":"You are not authorized to access that location.","messagePattern":"You are not authorized to access that location\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"warning","filePath":"plugins/PassboltEe/DirectorySync/src/Controller/DirectorySettingsController.php","lineNumber":53,"sourceCode":"     *\n     * @return void\n     * @throws \\Exception\n     */\n    public function initialize(): void\n    {\n        parent::initialize();\n        $this->loadComponent('ObfuscateFields', ['fields' => ['password']]);\n    }\n\n    /**\n     * Retrieve the settings\n     *\n     * @return void\n     */\n    public function view()\n    {\n        if (!$this->User->isAdmin()) {\n            throw new ForbiddenException(__('You are not authorized to access that location.'));\n        }\n\n        try {\n            $directoryOrgSettings = DirectoryOrgSettings::get();\n            $settings = $directoryOrgSettings->toArray();\n        } catch (RecordNotFoundException $e) {\n            $settings = [];\n        }\n\n        $formData = LdapConfigurationForm::formatOrgSettingsToFormData($settings);\n        $this->success(__('The operation was successful.'), $formData);\n    }\n\n    /**\n     * Update the settings\n     *\n     * @return void\n     */","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/DirectorySync/src/Controller/DirectorySettingsController.php#L35-L71","documentation":"DirectorySettingsController::view() throws this ForbiddenException (HTTP 403) when the authenticated user is not an administrator. Reading the directory sync settings via GET /directorysync/settings is admin-only. The request is authenticated and routed correctly, but the role check `$this->User->isAdmin()` failed.","triggerScenarios":"GET /directorysync/settings performed by a logged-in user whose role is not 'admin' (e.g. 'user' role).","commonSituations":"Service accounts or automation scripts using a non-admin user's token; users clicking into admin settings URLs; role changed after the token was issued; using a regular user's API key instead of an admin's.","solutions":["Authenticate the request with an administrator account's credentials/token.","Check the user's role and promote to admin if appropriate via the admin promotion flow.","Verify you are hitting the correct passbolt instance/environment where the account is an admin.","If automation is intended, create or use a dedicated admin service account."],"exampleFix":"// before\n# reading settings as a regular user\ncurl -H 'Authorization: Bearer <user-token>' https://passbolt.example.com/directorysync/settings.json\n// 403\n// after\n# use an admin account/token\ncurl -H 'Authorization: Bearer <admin-token>' https://passbolt.example.com/directorysync/settings.json","handlingStrategy":"validation","validationCode":"// ensure the token belongs to an admin before calling\nconst me = await api.get('/users/me.json');\nif (me.body.role.name !== 'admin') {\n    throw new Error('Admin role required to read directory sync settings');\n}","typeGuard":"function isAdminUser(user) {\n  return typeof user === 'object' && user !== null\n    && user.role?.name === 'admin';\n}","tryCatchPattern":"try {\n    const res = await api.get('/directorysync/settings.json');\n} catch (e) {\n    if (e.response?.status === 403) {\n        throw new Error('Current account is not an admin; use an admin token.');\n    }\n    throw e;\n}","preventionTips":["Use admin credentials for all /directorysync/* endpoints.","Resolve whoami/role before running admin automation scripts.","Promote users deliberately and re-issue tokens after role changes.","Keep service accounts for automation in the admin role if they must manage org settings."],"tags":["authorization","http-403","forbidden","role-check","ldap-directory-sync"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}