{"record":{"id":"0df442fd2df79d4b","repo":"passbolt/passbolt_api","slug":"the-scim-settings-could-not-be-encrypted-with-the-server-gpg","errorCode":null,"errorMessage":"The SCIM settings could not be encrypted with the server gpg key.","messagePattern":"The SCIM settings could not be encrypted with the server gpg key\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\InternalErrorException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltEe/Scim/src/Service/ScimBaseSettingsService.php","lineNumber":108,"sourceCode":"\n        return $data;\n    }\n\n    /**\n     * @param array $settingsValue\n     * @return string\n     */\n    protected function encryptSettings(array $settingsValue): string\n    {\n        try {\n            $gpg = OpenPGPBackendFactory::get();\n            $gpg = $this->setEncryptKeyWithServerKey($gpg);\n\n            $data = $gpg->encrypt(json_encode($settingsValue));\n        } catch (Exception $exception) {\n            $msg = $exception->getMessage() . ' ';\n            $msg .= __('The SCIM settings could not be encrypted with the server gpg key.');\n            throw new InternalErrorException($msg, 500, $exception);\n        }\n\n        return $data;\n    }\n\n    /**\n     * @return array<null>\n     */\n    protected function getDefaultSettings(): array\n    {\n        return [];\n    }\n}\n","sourceCodeStart":90,"sourceCodeEnd":122,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Service/ScimBaseSettingsService.php#L90-L122","documentation":"This InternalErrorException wraps any failure while encrypting SCIM settings before persisting them. encryptSettings() builds an OpenPGP backend, sets the server public key via setEncryptKeyWithServerKey(), and encrypts the JSON-encoded settings payload. If encryption fails, the raw GPG error is prefixed and rethrown as a 500; the settings are NOT saved.","triggerScenarios":"Calls to saveSettings, rehashToken or migrate when the server public key cannot be loaded or used: the passbolt.gpg.serverKey fingerprint does not match a key in the keyring, the public key file configured is missing/unreadable, GNUPGHOME is wrong for the web server user, or the GnuPG backend itself fails to initialize for the given payload.","commonSituations":"Fresh installs where the server key was never imported into the web-server user's keyring; instances migrated to a new server whose GNUPGHOME lacks the passbolt server key; wrong fingerprint configured in passbolt.php; permissions on ~/.gnupg owned by a different user (e.g. root vs www-data) after manual key generation.","solutions":["Re-import or regenerate the server GPG key so the configured fingerprint exists in the web server user's keyring (use passbolt's serverkey generation/import commands), then verify with passbolt healthcheck","Fix the passbolt.gpg.serverKey configuration (fingerprint, public key path) in config/passbolt.php so it points at the actual key in the keyring","Ensure GNUPGHOME for the web server user is correct and that ~/.gnupg and its files are owned by and readable/writable by that user","Clear the GnuPG keyring cache/misconfigured agent state if keys exist but encryption still fails, and retry the settings save"],"exampleFix":"// before (fingerprint not present in keyring)\n'passbolt' => ['gpg' => ['serverKey' => ['fingerprint' => 'ABSENT_FP', 'public' => '/wrong/key.asc']]],\n\n// after\n'passbolt' => ['gpg' => ['serverKey' => ['fingerprint' => 'FP_OF_IMPORTED_KEY', 'public' => '/home/www-data/.gnupg/serverkey.asc']]],","handlingStrategy":"try-catch","validationCode":"$fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');\n$info = gnupg_keyinfo($gpg, $fingerprint);\nif (empty($info) || empty($info[0]['subkeys'][0]['can_encrypt'] ?? false)) {\n  throw new Exception('Server key cannot encrypt: fingerprint missing from keyring');\n}","typeGuard":"function serverKeyIsEncryptable(string $fingerprint, string $gnupgHome): bool {\n  $gpg = gnupg_init();\n  putenv(\"GNUPGHOME=$gnupgHome\");\n  $keys = gnupg_keyinfo($gpg, $fingerprint);\n  return !empty($keys);\n}","tryCatchPattern":"try {\n  $service->saveSettings($uac, $data);\n} catch (InternalErrorException $e) {\n  $this->log('SCIM settings encryption failed: ' . $e->getMessage());\n  // fix server key config, then retry save\n}","preventionTips":["Verify the server key fingerprint exists in the web-server user's keyring after installs and migrations","Ensure GNUPGHOME ownership/permissions match the web server user","Run GPG healthchecks in deployment pipelines before enabling SCIM","Keep the public key file path in config accurate and readable"],"tags":["scim","gpg","encryption","server-key"],"backgroundTag":"file-encryption-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}