{"record":{"id":"62fb47947c8238b2","repo":"passbolt/passbolt_api","slug":"no-valid-sso-settings-found-recoverstartcontroller","errorCode":null,"errorMessage":"No valid SSO settings found.","messagePattern":"No valid SSO settings found\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Controller/RecoverStartController.php","lineNumber":62,"sourceCode":"\n    /**\n     * Exchange authentication token for recover URL.\n     *\n     * @return void\n     */\n    public function start(): void\n    {\n        if (!$this->request->is('json')) {\n            throw new BadRequestException(__('This is not a valid Ajax/Json request.'));\n        }\n\n        $this->User->assertNotLoggedIn();\n\n        // Make sure SSO settings are set.\n        try {\n            $settingsDto = (new SsoSettingsGetService())->getActiveOrFail();\n        } catch (RecordNotFoundException $e) {\n            throw new BadRequestException(__('No valid SSO settings found.'), null, $e);\n        }\n\n        $form = new SsoRecoverStartForm();\n        if (!$form->execute($this->getRequest()->getData())) {\n            throw new FormValidationException(__('Could not validate the SSO recover request.'), $form);\n        }\n\n        // Assert & consume sso auth token\n        $ssoAuthService = new SsoAuthenticationTokenGetService();\n        try {\n            $ssoAuthToken = $ssoAuthService->getOrFail(\n                $form->getData('token'),\n                SsoState::TYPE_SSO_RECOVER\n            );\n        } catch (RecordNotFoundException $e) {\n            throw new BadRequestException($e->getMessage(), null, $e);\n        }\n","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Controller/RecoverStartController.php#L44-L80","documentation":"Thrown by RecoverStartController::start when getActiveOrFail() finds no active SSO settings, wrapped from RecordNotFoundException. The SSO recover-start flow cannot proceed without configured and active SSO settings on the instance.","triggerScenarios":"POST /sso/recover/start while sso_settings has no active row; settings only in draft/inactive state; wrong environment queried.","commonSituations":"Fresh instance with SSO plugin enabled but unconfigured; settings deactivated by an admin; staging DB missing production SSO config; org switched providers and old rows deactivated before new ones saved.","solutions":["Configure and activate SSO settings as administrator before using SSO recover","Verify active settings via GET /sso/settings (as admin)","Check the sso_settings table status column for an active record","Use the standard (non-SSO) /recover endpoint when SSO is not configured"],"exampleFix":"// before\nPOST /sso/recover/start  -> 400 No valid SSO settings found.\n// after\nPOST /sso/settings {...} -> activate -> POST /sso/recover/start","handlingStrategy":"fallback","validationCode":"const cfg = await fetch('/sso/settings.json').then(r => r.json());\nif (!cfg.body?.providers?.length) useStandardRecover();","typeGuard":null,"tryCatchPattern":"try {\n  await ssoRecoverStart(username);\n} catch (e) {\n  if (e.message.includes('No valid SSO settings')) redirectToStandardRecover();\n  else throw e;\n}","preventionTips":["Gate SSO UI behind an active-settings check from the API","Keep SSO settings configured in all environments (staging/prod parity)","Fall back to the classic /recover endpoint when SSO is absent","Alert admins when SSO settings are deactivated"],"tags":["sso","configuration","missing-settings"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}