{"record":{"id":"4b54ac70f795a5dd","repo":"passbolt/passbolt_api","slug":"the-sso-settings-do-not-exist-googlerecoverlogincontroller","errorCode":null,"errorMessage":"The SSO settings do not exist.","messagePattern":"The SSO settings do not exist\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Controller/Google/GoogleRecoverLoginController.php","lineNumber":54,"sourceCode":"    public function beforeFilter(EventInterface $event)\n    {\n        parent::beforeFilter($event);\n\n        $this->Authentication->allowUnauthenticated(['login']);\n    }\n\n    /**\n     * Return a URL to redirect the user to perform SSO (without hint)\n     *\n     * @param \\App\\Service\\Cookie\\AbstractSecureCookieService $cookieService Cookie service\n     * @return void\n     */\n    public function login(AbstractSecureCookieService $cookieService): void\n    {\n        try {\n            (new SsoSettingsGetService())->getActiveOrFail();\n        } catch (RecordNotFoundException $e) {\n            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);\n        }\n\n        $this->User->assertNotLoggedIn();\n\n        $uac = new ExtendedUserAccessControl(\n            Role::GUEST,\n            null,\n            null,\n            $this->User->ip(),\n            $this->User->userAgent()\n        );\n\n        $url = $this->getSsoUrlWithCookie(new SsoGoogleService($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);\n\n        $this->success(__('The operation was successful.'), $url->jsonSerialize());\n    }\n}\n","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Controller/Google/GoogleRecoverLoginController.php#L36-L72","documentation":"This BadRequestException is thrown by the Google SSO recover-login controller when SsoSettingsGetService::getActiveOrFail raises RecordNotFoundException, meaning there is no active SSO settings row in the database. The recover login flow requires SSO to be configured and active before it can start an OAuth login.","triggerScenarios":"GET /sso/recover/login/google while no SSO provider is enabled (sso_settings table has no active record), or the settings were disabled/deleted after the user received the recover email.","commonSituations":"Administrator disabled or deleted the SSO configuration after recovery emails were sent; user clicks an old Google SSO recovery link after SSO was turned off; database restored/migrated without the sso_settings rows; wrong environment (staging DB without SSO configured).","solutions":["Re-enable or reconfigure SSO in the administration workspace (SSO settings must be active).","Have the user recover using the traditional passphrase flow instead of SSO.","Confirm you are hitting the environment where SSO is actually configured.","Inspect the sso_settings table for an active record and check migration status if settings were expected to exist."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Admin pre-check: confirm an active SSO configuration exists before sending recover emails\nconst settings = await ssoSettingsApi.get();\nif (!settings || settings.provider === null) throw new Error('SSO is not active; recovery emails will fail.');","typeGuard":"function ssoIsActive(settings) {\n  return settings != null && typeof settings.id === 'string' && settings.status === 'active';\n}","tryCatchPattern":"try {\n  await startGoogleSsoRecoverLogin();\n} catch (e) {\n  if (e.message.includes('The SSO settings do not exist')) {\n    fallbackToPassphraseRecovery();\n  }\n}","preventionTips":["Verify SSO is enabled/active before distributing SSO recovery links.","Re-send recovery emails after any SSO configuration change.","Keep environments' SSO settings in sync if links are shared across them.","Monitor sso_settings table state after migrations or restores."],"tags":["sso","configuration","settings-missing","google"],"backgroundTag":"missing-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}