{"record":{"id":"6cb7013c80893e44","repo":"passbolt/passbolt_api","slug":"could-not-validate-the-scim-settings-found-in-database","errorCode":null,"errorMessage":"Could not validate the SCIM settings found in database.","messagePattern":"Could not validate the SCIM settings found in database\\.","errorType":"exception","errorClass":"Passbolt\\Scim\\Exception\\FormValidationException","httpStatus":500,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Service/ScimGetSettingsService.php","lineNumber":74,"sourceCode":"        /** @var \\Passbolt\\Scim\\Model\\Table\\ScimSettingsTable $scimSettingsTable */\n        $scimSettingsTable = $this->fetchTable('Passbolt/Scim.ScimSettings');\n\n        /** @var \\Passbolt\\Scim\\Model\\Entity\\ScimSetting|null $settings */\n        $settings = $scimSettingsTable->find()->first();\n\n        if (is_null($settings)) {\n            return null;\n        }\n        $value = $this->decryptSettings($settings);\n        $form = new ScimSettingsForm();\n\n        if (!$form->execute($value, ['newRecord' => false])) {\n            $validationException = new FormValidationException(\n                __('Could not validate the SCIM settings found in database.'),\n                $form\n            );\n\n            throw new InternalErrorException($validationException->getMessage(), 500, $validationException);\n        }\n\n        return ScimSettingsDto::createFromArray([\n            'id' => $settings->id,\n            'setting_id' => Hash::get($value, 'setting_id'),\n            'scim_user_id' => Hash::get($value, 'scim_user_id'),\n            'base_api_endpoint' => Router::url('scim/v2/' . Hash::get($value, 'setting_id'), true),\n            'expired' => Hash::get($value, 'expired'),\n            'created' => $settings->created,\n            'created_by' => $settings->created_by,\n            'modified' => $settings->modified,\n            'modified_by' => $settings->modified_by,\n        ]);\n    }\n}\n","sourceCodeStart":56,"sourceCodeEnd":90,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Service/ScimGetSettingsService.php#L56-L90","documentation":"ScimGetSettingsService::getSettings() reads the single SCIM settings row from the database, decrypts it, and re-validates it with ScimSettingsForm. If the stored data fails form validation, it wraps the failure in an InternalErrorException with this message. This signals corrupted, legacy-format, or manually-tampered SCIM settings persisted in the `scim_settings` table — not a client input problem.","triggerScenarios":"GET /scim-settings (admin settings read) when a row exists in scim_settings whose decrypted payload fails ScimSettingsForm validation: e.g. missing required keys, malformed setting_id/scim_user_id, or values written by an older plugin version whose schema no longer validates.","commonSituations":"Manual edits to the scim_settings table rows, restore of a database from an older passbolt version, partial/corrupted encrypted payload after key changes, or an upgrade that tightened ScimSettingsForm validation rules against previously-accepted data.","solutions":["Inspect the decrypted settings row: delete the row from scim_settings so the plugin falls back to default (unset) settings, then re-create the SCIM settings via the admin UI.","Check the form errors (they are attached to the chained FormValidationException) via the exception stack/log to see exactly which field failed validation.","Verify the server encryption keys are intact — a wrong key yields garbage on decryptSettings(), which then fails validation.","If this appeared after a passbolt upgrade, compare ScimSettingsForm validation rules with the stored data and migrate the row to the expected format instead of deleting."],"exampleFix":"// Remove corrupted row so defaults are used (MySQL)\nDELETE FROM scim_settings WHERE id = '<corrupted-row-uuid>';\n// Then re-save SCIM settings through Admin > SCIM settings UI","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    $settings = (new ScimGetSettingsService())->getSettings();\n} catch (InternalErrorException $e) {\n    $previous = $e->getPrevious();\n    if ($previous instanceof FormValidationException) {\n        Log::error('SCIM settings corrupt: ' . json_encode($previous->getForm()->getErrors()));\n    }\n    // fall back to default/unset settings and prompt admin to re-save\n}","preventionTips":["Never edit the scim_settings table manually; use the admin UI/API.","After restoring DB backups, re-save SCIM settings through the API once.","Verify server GPG/encryption keys before enabling SCIM.","Log form errors from the chained FormValidationException to catch format drift early."],"tags":["scim","php","cakephp","database","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}