{"record":{"id":"172d21418575d89b","repo":"passbolt/passbolt_api","slug":"the-sso-settings-do-not-exist-adfsrecoverlogincontroller","errorCode":null,"errorMessage":"The SSO settings do not exist.","messagePattern":"The SSO settings do not exist\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Controller/Adfs/AdfsRecoverLoginController.php","lineNumber":53,"sourceCode":"     */\n    public function beforeFilter(EventInterface $event)\n    {\n        parent::beforeFilter($event);\n        $this->Authentication->allowUnauthenticated(['login']);\n    }\n\n    /**\n     * Return a URL to redirect the user to perform SSO (without hint)\n     *\n     * @param \\App\\Service\\Cookie\\AbstractSecureCookieService $cookieService Cookie service\n     * @return void\n     */\n    public function login(AbstractSecureCookieService $cookieService): void\n    {\n        try {\n            (new SsoSettingsGetService())->getActiveOrFail();\n        } catch (RecordNotFoundException $e) {\n            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);\n        }\n\n        $this->User->assertNotLoggedIn();\n\n        $uac = new ExtendedUserAccessControl(\n            Role::GUEST,\n            null,\n            null,\n            $this->User->ip(),\n            $this->User->userAgent()\n        );\n\n        $url = $this->getSsoUrlWithCookie(new SsoAdfsService($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);\n\n        $this->success(__('The operation was successful.'), $url->jsonSerialize());\n    }\n}\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Controller/Adfs/AdfsRecoverLoginController.php#L35-L71","documentation":"The ADFS recover-login endpoint requires an active SSO configuration to build the SSO transaction. SsoSettingsGetService::getActiveOrFail() throws RecordNotFoundException when no active SSO settings row exists, which the controller converts into a BadRequestException telling the user the SSO settings do not exist.","triggerScenarios":"A user hits the ADFS recover login URL (/sso/recover/login/adfs or equivalent) while SSO has been deactivated, deleted, or was never configured for the organization.","commonSituations":"SSO was disabled/removed after recovery emails with SSO links were already sent; stale emailed links used after settings deletion; users bookmarking recover URLs; testing ADFS flow before saving settings.","solutions":["Reconfigure and activate SSO settings (via admin UI or ./bin/cake passbolt sso_settings) before using the ADFS recover flow","Ask users to use the standard (non-SSO) recover flow if SSO is intentionally disabled","Verify which SSO provider is active — the ADFS URL only works when the ADFS provider is the active setting","Check the sso_settings table for an active record and correct provider type"],"exampleFix":"// before: relying on stale emailed link after SSO removal\nGET /sso/recover/login/adfs?...  -> 400 The SSO settings do not exist.\n// after: reactivate settings or route the user to standard recover\n(new SsoSettingsSetService())->createOrUpdate($adminUac, $adfsSettingsDto);\nGET /sso/recover/login/adfs?...  -> 302 to ADFS","handlingStrategy":"try-catch","validationCode":"try {\n    $settings = (new \\Passbolt\\Sso\\Service\\SsoSettingsGetService())->getActiveOrFail();\n    $isAdfs = $settings->provider === \\Passbolt\\Sso\\Model\\Entity\\SsoSettings::PROVIDER_ADFS;\n} catch (\\Cake\\Datasource\\Exception\\RecordNotFoundException $e) {\n    // SSO inactive: redirect to standard recover instead of the SSO URL\n}","typeGuard":null,"tryCatchPattern":"try {\n    return $this->redirect($adfsRecoverLoginUrl);\n} catch (\\Cake\\Http\\Exception\\BadRequestException $e) {\n    if ($e->getMessage() === 'The SSO settings do not exist.') {\n        return $this->redirect('/recover');\n    }\n    throw $e;\n}","preventionTips":["Deactivate or regenerate emailed SSO recover links when toggling SSO off","Check active SSO settings before sending recovery emails with SSO links","Match the URL provider segment to the actually-active provider","Test the recover flow after every SSO settings change"],"tags":["sso","recover","adfs","missing-settings"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}