{"record":{"id":"5d8aee77f91e4d3e","repo":"passbolt/passbolt_api","slug":"the-scim-settings-could-not-be-decrypted-with-the-server-gpg","errorCode":null,"errorMessage":"The SCIM settings could not be decrypted with the server gpg key.","messagePattern":"The SCIM settings could not be decrypted with the server gpg key\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\InternalErrorException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltEe/Scim/src/Service/ScimBaseSettingsService.php","lineNumber":88,"sourceCode":"    /**\n     * @param \\Passbolt\\Scim\\Model\\Entity\\ScimSetting $scimSetting\n     * @return array\n     */\n    protected function decryptSettings(ScimSetting $scimSetting): array\n    {\n        $value = $scimSetting->get('value');\n        if (!$value) {\n            return $this->getDefaultSettings();\n        }\n\n        try {\n            $gpg = OpenPGPBackendFactory::get();\n            $gpg = $this->setDecryptKeyWithServerKey($gpg);\n            $data = json_decode($gpg->decrypt($value), associative: true);\n        } catch (Exception $exception) {\n            $msg = $exception->getMessage() . ' ';\n            $msg .= __('The SCIM settings could not be decrypted with the server gpg key.');\n            throw new InternalErrorException($msg, 500, $exception);\n        }\n\n        return $data;\n    }\n\n    /**\n     * @param array $settingsValue\n     * @return string\n     */\n    protected function encryptSettings(array $settingsValue): string\n    {\n        try {\n            $gpg = OpenPGPBackendFactory::get();\n            $gpg = $this->setEncryptKeyWithServerKey($gpg);\n\n            $data = $gpg->encrypt(json_encode($settingsValue));\n        } catch (Exception $exception) {\n            $msg = $exception->getMessage() . ' ';","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Service/ScimBaseSettingsService.php#L70-L106","documentation":"This InternalErrorException wraps any failure while decrypting the stored SCIM settings payload with the passbolt server GPG key. SCIM settings (including the secret token) are stored in the scim_settings table encrypted at rest; decryptSettings() loads the OpenPGP backend, sets the server decrypt key, and decrypts+json_decodes the value. If GPG decryption or JSON decoding of the stored blob fails, the underlying message is prefixed and rethrown as a 500.","triggerScenarios":"Calling any service that reads stored SCIM settings (getRenderedValue, getSettingsDecryptedValue, getSettings, saveSettings, rehashToken, migrate) when the row's 'value' column cannot be decrypted: the server GPG key passphrase in config is wrong/missing, the server keypair was replaced or regenerated, the GNUPGHOME environment points to a different keyring, the encrypted value was written by another instance with a different server key, or the stored value is corrupted/truncated.","commonSituations":"Migrating a passbolt instance to a new server without copying the server GPG keyring and passphrase; rotating or regenerating serverkey after server recovery; misconfigured 'passbolt.gpg.serverKey' fingerprint/passphrase in passbolt.php; restoring a database dump without restoring /home/www-data/.gnupg; multi-instance setups sharing one database but not the same key.","solutions":["Verify the server GPG key configuration (passbolt.gpg.serverKey fingerprint, public/private key files and passphrase) and that the key exists in the GNUPGHOME keyring of the web server user; run passbolt healthcheck for GPG checks","Restore the original server GPG keypair and keyring used when the SCIM settings were encrypted (copy ~/.gnupg from the previous server) so the value can be decrypted again","If the original key is unrecoverable, delete the stale SCIM setting row(s) and re-create the SCIM configuration through the settings endpoint so it is re-encrypted with the current server key","Check that the GNUPGHOME environment variable for the web/CLI user matches the keyring containing the server secret key, and that file permissions allow the web server user to read it","Read the prefixed underlying GPG exception message in the error log to distinguish passphrase errors from missing-key/corruption errors and act accordingly"],"exampleFix":"// before (wrong passphrase in config/passbolt.php)\n'passbolt' => ['gpg' => ['serverKey' => ['fingerprint' => 'OLD_FP', 'passphrase' => 'wrong']]],\n\n// after (matching the key in the server keyring)\n'passbolt' => ['gpg' => ['serverKey' => ['fingerprint' => 'CORRECT_FP', 'passphrase' => 'correct']]],","handlingStrategy":"try-catch","validationCode":"// before reading settings, verify GPG health\n$healthcheck = shell_exec('bin/cake passbolt healthcheck --gpg');\nif (str_contains($healthcheck, 'fail')) { /* abort and fix server key config */ }","typeGuard":"function isDecryptable(?string $storedValue): bool {\n  return is_string($storedValue) && str_starts_with($storedValue, '-----BEGIN PGP MESSAGE-----');\n}","tryCatchPattern":"try {\n  $data = $service->getSettings($uac);\n} catch (InternalErrorException $e) {\n  $this->log('SCIM settings decryption failed: ' . $e->getMessage());\n  // re-create SCIM settings or restore server key\n}","preventionTips":["Back up the server GPG keypair and keyring together with the database","Never regenerate the server key without first decrypting/re-encrypting stored secrets","Run passbolt healthcheck after every server migration","Keep passbolt.gpg.serverKey fingerprint and passphrase in sync with the actual keyring"],"tags":["scim","gpg","encryption","server-key","decryption"],"backgroundTag":"file-decryption-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}