{"record":{"id":"4e35698d33c6b788","repo":"passbolt/passbolt_api","slug":"the-sso-key-does-not-exist-ssokeysgetservice","errorCode":null,"errorMessage":"The SSO key does not exist.","messagePattern":"The SSO key does not exist\\.","errorType":"exception","errorClass":"RecordNotFoundException","httpStatus":404,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/SsoKeys/SsoKeysGetService.php","lineNumber":58,"sourceCode":"        try {\n            $ssoSettingEntity = (new SsoSettingsGetService())->getActiveOrFail();\n            // Token must be provided and matching the settings, user id, ip, user agent, etc.\n            $ssoAuthTokenGetService = new SsoAuthenticationTokenGetService();\n            $ssoAuthToken = $ssoAuthTokenGetService->getOrFail(\n                $token,\n                SsoState::TYPE_SSO_GET_KEY\n            );\n            $ssoAuthTokenGetService->assertAndConsume($ssoAuthToken, $uac, $ssoSettingEntity->id);\n        } catch (RecordNotFoundException $exception) {\n            throw new BadRequestException($exception->getMessage(), 400, $exception);\n        }\n\n        try {\n            $SsoKeys = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoKeys');\n            /** @var \\Passbolt\\Sso\\Model\\Entity\\SsoKey $key entity */\n            $key = $SsoKeys->find()->where(['id' => $keyId, 'user_id' => $uac->getId()])->firstOrFail();\n        } catch (RecordNotFoundException $exception) {\n            throw new RecordNotFoundException(__('The SSO key does not exist.'), 404, $exception);\n        }\n\n        return $key;\n    }\n}\n","sourceCodeStart":40,"sourceCodeEnd":64,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoKeys/SsoKeysGetService.php#L40-L64","documentation":"After the SSO token is validated and consumed, get() loads the SsoKey scoped to both key id and the current user id; if firstOrFail() finds nothing it throws RecordNotFoundException('The SSO key does not exist.') with HTTP 404. Note this service throws RecordNotFoundException (not NotFoundException), so the caller/controller is responsible for translating it into a 404 response.","triggerScenarios":"Requesting an SSO key with an id that does not exist, was deleted, or belongs to a different user (lookup is filtered by user_id = uac->getId()).","commonSituations":"Key deleted between token exchange and key fetch; wrong user session completing the flow; id taken from a different environment/instance; race with an admin rotating SSO settings that purged keys.","solutions":["Verify the key id belongs to the authenticated user and still exists in sso_keys","Restart the SSO key exchange flow to create a fresh key","Handle the RecordNotFoundException in the controller to return a proper 404 to the client","Confirm client and server point at the same passbolt instance/database"],"exampleFix":"// before: unhandled RecordNotFoundException bubbles as 500\n$key = $this->SsoKeysGetService->get($uac, $tokenId, $keyId);\n// after: caller maps to 404\ntry {\n    $key = $this->SsoKeysGetService->get($uac, $tokenId, $keyId);\n} catch (RecordNotFoundException $e) {\n    throw new NotFoundException($e->getMessage());\n}","handlingStrategy":"try-catch","validationCode":"// pre-check key existence and ownership\n$key = $SsoKeys->find()->where(['id' => $keyId, 'user_id' => $uac->getId()])->first();\nif (!$key) {\n    restartSsoKeyExchange();\n}","typeGuard":null,"tryCatchPattern":"try {\n    $key = $ssoKeysGetService->get($uac, $token, $keyId);\n} catch (RecordNotFoundException $e) {\n    throw new NotFoundException($e->getMessage()); // map to HTTP 404\n}","preventionTips":["Complete the key exchange without deleting the key mid-flow","Keep the same user session across both SSO steps","Catch RecordNotFoundException in controllers to return 404, not 500"],"tags":["sso","not-found","resource-missing","record-not-found"],"backgroundTag":"entity-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}