{"record":{"id":"1ae464cc997ffc8f","repo":"passbolt/passbolt_api","slug":"the-sso-settings-do-not-exist-oauth2recoverlogincontroller","errorCode":null,"errorMessage":"The SSO settings do not exist.","messagePattern":"The SSO settings do not exist\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Controller/OAuth2/OAuth2RecoverLoginController.php","lineNumber":53,"sourceCode":"     */\n    public function beforeFilter(EventInterface $event)\n    {\n        parent::beforeFilter($event);\n        $this->Authentication->allowUnauthenticated(['login']);\n    }\n\n    /**\n     * Return a URL to redirect the user to perform SSO (without hint)\n     *\n     * @param \\App\\Service\\Cookie\\AbstractSecureCookieService $cookieService Cookie service\n     * @return void\n     */\n    public function login(AbstractSecureCookieService $cookieService): void\n    {\n        try {\n            (new SsoSettingsGetService())->getActiveOrFail();\n        } catch (RecordNotFoundException $e) {\n            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);\n        }\n\n        $this->User->assertNotLoggedIn();\n\n        $uac = new ExtendedUserAccessControl(\n            Role::GUEST,\n            null,\n            null,\n            $this->User->ip(),\n            $this->User->userAgent()\n        );\n\n        $url = $this->getSsoUrlWithCookie(new SsoOAuth2Service($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);\n\n        $this->success(__('The operation was successful.'), $url->jsonSerialize());\n    }\n}\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Controller/OAuth2/OAuth2RecoverLoginController.php#L35-L71","documentation":"This BadRequestException is thrown by the generic OAuth2 SSO recover-login controller when SsoSettingsGetService::getActiveOrFail finds no active SSO settings record (RecordNotFoundException). Starting an OAuth2-based recovery login requires an active SSO configuration on the instance.","triggerScenarios":"GET /sso/recover/login/oauth2 while SSO is disabled or deleted (no active row in sso_settings), or the provider configuration was changed to inactive after recovery emails were sent.","commonSituations":"Admin removed or disabled the OAuth2 SSO provider after sending recovery emails; user clicks a stale recovery link; environment mismatch (e.g. production link opened against a local instance without SSO configured).","solutions":["Re-enable the SSO/OAuth2 configuration in the admin SSO settings.","Fall back to the standard passphrase-based account recovery.","Verify the correct environment/instance is being used where SSO is active.","Check the sso_settings table and recent migrations if the configuration should exist."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Before starting recovery, check SSO availability\nconst settings = await ssoSettingsApi.get();\nif (!settings) throw new Error('No active SSO settings; OAuth2 recovery login is unavailable.');","typeGuard":"function hasActiveSso(settings) {\n  return settings != null && typeof settings.id === 'string' && settings.status === 'active';\n}","tryCatchPattern":"try {\n  await startOauth2SsoRecoverLogin();\n} catch (e) {\n  if (e.message.includes('The SSO settings do not exist')) {\n    fallbackToPassphraseRecovery();\n  }\n}","preventionTips":["Ensure the OAuth2 SSO provider is configured and active before users attempt recovery.","Re-issue recovery emails after SSO configuration changes.","Verify the correct instance/environment URL in recovery links.","Check sso_settings contents after DB restores or migrations."],"tags":["sso","configuration","settings-missing","oauth2"],"backgroundTag":"missing-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}