{"record":{"id":"373d8432e2ecba36","repo":"passbolt/passbolt_api","slug":"the-user-does-not-exist-or-has-been-deleted-373d84","errorCode":null,"errorMessage":"The user does not exist or has been deleted.","messagePattern":"The user does not exist or has been deleted\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Service/SsoRecoverAssertService.php","lineNumber":118,"sourceCode":"            $uac,\n            SsoState::TYPE_SSO_RECOVER,\n            $ssoService->getSettings()->id\n        );\n\n        return Router::url(\"/sso/recover/{$provider}/success?token={$ssoAuthToken->token}\", true);\n    }\n\n    /**\n     * @param \\Passbolt\\Sso\\Utility\\OpenId\\SsoResourceOwnerInterface $resourceOwner Resource owner.\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException When self-registration plugin is disabled.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException When email domain is not allowed.\n     * @throws \\Cake\\Http\\Exception\\BadRequestException When email domains doesn't exist.\n     */\n    private function isAllowedForSelfRegister(SsoResourceOwnerInterface $resourceOwner): void\n    {\n        if (!$this->isFeaturePluginEnabled('SelfRegistration')) {\n            throw new BadRequestException(__('The user does not exist or has been deleted.'));\n        }\n\n        $selfRegistrationService = new SelfRegistrationEmailDomainsDryRunService();\n        $data = ['email' => $resourceOwner->getEmail()];\n\n        try {\n            $selfRegistrationService->canGuestSelfRegister($data);\n        } catch (CustomValidationException | ForbiddenException $e) {\n            $msg = __('Access to this service requires an invitation. ');\n            $msg .= __('Please contact your administrator to request an invitation link.');\n\n            throw new BadRequestException($msg, null, $e);\n        }\n    }\n}\n","sourceCodeStart":100,"sourceCodeEnd":134,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Service/SsoRecoverAssertService.php#L100-L134","documentation":"During SSO recovery, isAllowedForSelfRegister checks that the SelfRegistration feature plugin is enabled before allowing a non-existent user to self-register via the SSO provider. If the plugin is disabled, passbolt cannot verify the email domain is allowed and reports the user as nonexistent/deleted.","triggerScenarios":"A user not yet in the database completes SSO authentication while the SelfRegistration (EE) plugin is disabled; assertAndGetRedirectUrl -> isAllowedForSelfRegister runs with the feature flag off.","commonSituations":"Fresh EE install where self-registration was never enabled; admin disabled the SelfRegistration plugin but users still try to sign up through SSO; license expired so EE plugins fail to load.","solutions":["Enable the SelfRegistration plugin: set passbolt plugins SelfRegistration enabled true in config (and have a valid EE subscription)","Alternatively, create the user account first (admin sends an invitation) so SSO recover proceeds for an existing user","Check config/passbolt.php or self-registration settings in the admin UI to confirm an allowed domain is configured","Verify the subscription key is valid so EE plugins load"],"exampleFix":"// config/passbolt.php\n'plugins' => [\n    'SelfRegistration' => ['enabled' => true],\n]","handlingStrategy":"validation","validationCode":"// admin-side pre-check\nconst settings = await fetch('/selfregistration/settings.jsonapi').then(r => r.json());\nconst enabled = settings.data?.providers?.emailDomain?.enabled ?? false;\nif (!enabled) console.warn('SelfRegistration disabled: unknown SSO users cannot self-register');","typeGuard":null,"tryCatchPattern":"try {\n  const res = await fetch('/sso/recover/...');\n  if (!res.ok) {\n    const body = await res.json();\n    if (body.message === 'The user does not exist or has been deleted.') {\n      showInviteRequiredScreen();\n    }\n  }\n} catch (e) { /* network error */ }","preventionTips":["Enable the SelfRegistration EE plugin with a valid subscription if users should self-register via SSO","Provision users before they first log in through SSO","Keep EE subscription active so feature plugins load"],"tags":["sso","feature-flag","self-registration","account-recovery"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}