{"record":{"id":"264638cfca08050b","repo":"passbolt/passbolt_api","slug":"access-to-this-service-requires-an-invitation-please-contact","errorCode":null,"errorMessage":"Access to this service requires an invitation. Please contact your administrator to request an invitation link.","messagePattern":"Access to this service requires an invitation\\. Please contact your administrator to request an invitation link\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Service/SsoRecoverAssertService.php","lineNumber":130,"sourceCode":"     * @throws \\Cake\\Http\\Exception\\BadRequestException When email domain is not allowed.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException When email domains doesn't exist.\n     */\n    private function isAllowedForSelfRegister(SsoResourceOwnerInterface $resourceOwner): void\n    {\n        if (!$this->isFeaturePluginEnabled('SelfRegistration')) {\n            throw new BadRequestException(__('The user does not exist or has been deleted.'));\n        }\n\n        $selfRegistrationService = new SelfRegistrationEmailDomainsDryRunService();\n        $data = ['email' => $resourceOwner->getEmail()];\n\n        try {\n            $selfRegistrationService->canGuestSelfRegister($data);\n        } catch (CustomValidationException | ForbiddenException $e) {\n            $msg = __('Access to this service requires an invitation. ');\n            $msg .= __('Please contact your administrator to request an invitation link.');\n\n            throw new BadRequestException($msg, null, $e);\n        }\n    }\n}\n","sourceCodeStart":112,"sourceCodeEnd":134,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Service/SsoRecoverAssertService.php#L112-L134","documentation":"After SSO authentication, passbolt checks via SelfRegistrationEmailDomainsDryRunService whether the provider-supplied email's domain is permitted for guest self-registration. If canGuestSelfRegister throws CustomValidationException or ForbiddenException (domain not allowed / self-registration off), the user is told they need an invitation.","triggerScenarios":"A user authenticates successfully with the SSO provider but their email domain is not in the self-registration allowed-domains list; self-registration is set to invite-only.","commonSituations":"Employees of a newly acquired company with a different email domain; personal Google accounts used against a corporate SSO setup; admin recently restricted the allowed domains list; user email domain typo in admin settings.","solutions":["Add the user's email domain in Admin Workspace > Self Registration settings (or use the API to update allowed domains)","Invite the user manually via Users > Invite so they get an invitation link","Ask the user to sign in with an account on an allowed domain","Verify the dry-run domain configuration matches the domain the IdP sends"],"exampleFix":"// before: allowed domains = ['example.com'], user logs in as alice@other-company.com\n// after (admin adds domain)\nPUT /selfregistration/settings.jsonapi\n{\"providers\": {\"emailDomain\": {\"allowedDomains\": [\"example.com\", \"other-company.com\"]}}}","handlingStrategy":"try-catch","validationCode":"const domain = email.split('@')[1];\nconst allowed = await fetch('/selfregistration/settings.jsonapi').then(r => r.json());\nconst domains = allowed.data?.providers?.emailDomain?.allowedDomains ?? [];\nif (!domains.includes(domain)) console.warn('Domain not allowed, user needs an invitation');","typeGuard":null,"tryCatchPattern":"try {\n  await startSsoRecover();\n} catch (e) {\n  if (String(e.message).includes('requires an invitation')) {\n    redirectToInviteRequestForm();\n  } else { throw e; }\n}","preventionTips":["Keep the self-registration allowed-domains list in sync with all corporate email domains","Use email-domain scoping in the IdP to restrict which accounts can authenticate","Regularly audit which domains can self-register"],"tags":["sso","self-registration","email-domain","forbidden","policy"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}