{"record":{"id":"71a1ab00b2eb728d","repo":"passbolt/passbolt_api","slug":"the-sso-settings-do-not-exist-pingonerecoverlogincontroller","errorCode":null,"errorMessage":"The SSO settings do not exist.","messagePattern":"The SSO settings do not exist\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/SsoRecover/src/Controller/PingOne/PingOneRecoverLoginController.php","lineNumber":53,"sourceCode":"     */\n    public function beforeFilter(EventInterface $event)\n    {\n        parent::beforeFilter($event);\n        $this->Authentication->allowUnauthenticated(['login']);\n    }\n\n    /**\n     * Return a URL to redirect the user to perform SSO (without hint)\n     *\n     * @param \\App\\Service\\Cookie\\AbstractSecureCookieService $cookieService Cookie service\n     * @return void\n     */\n    public function login(AbstractSecureCookieService $cookieService): void\n    {\n        try {\n            (new SsoSettingsGetService())->getActiveOrFail();\n        } catch (RecordNotFoundException $e) {\n            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);\n        }\n\n        $this->User->assertNotLoggedIn();\n\n        $uac = new ExtendedUserAccessControl(\n            Role::GUEST,\n            null,\n            null,\n            $this->User->ip(),\n            $this->User->userAgent()\n        );\n\n        $url = $this->getSsoUrlWithCookie(new SsoPingOneService($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);\n\n        $this->success(__('The operation was successful.'), $url->jsonSerialize());\n    }\n}\n","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/SsoRecover/src/Controller/PingOne/PingOneRecoverLoginController.php#L35-L71","documentation":"Thrown by PingOneRecoverLoginController::login when SsoSettingsGetService::getActiveOrFail() raises RecordNotFoundException, meaning no active SSO settings row exists in the database. Passbolt requires configured, active SSO settings before serving any PingOne SSO recovery login endpoint.","triggerScenarios":"GET request to the PingOne SSO recover login endpoint while the sso_settings table has no row in an active state (or none at all); SSO settings were deleted or disabled.","commonSituations":"SSO plugin enabled in code but settings never saved via admin UI/API; environment restored from a backup without sso_settings; settings deactivated during a provider migration (e.g. switching away from PingOne).","solutions":["Configure SSO settings as admin (Admin workspace > SSO or POST /sso/settings) and activate them","Verify the sso_settings table contains a row with status set to active via DB query or GET /sso/settings","Confirm you are on the correct instance/environment where SSO was configured","If SSO is not intended, use the standard non-SSO recover/login endpoints"],"exampleFix":"// before: endpoint called with no settings\nGET /sso/recover/pingone/login  -> 400 The SSO settings do not exist.\n// after: configure first\nPOST /sso/settings (provider: pingone, ...) -> activate -> GET /sso/recover/pingone/login","handlingStrategy":"validation","validationCode":"const settings = await fetch('/sso/settings.json', {headers: authHeaders});\nif (!settings.ok || !(await settings.json()).body?.some(s => s.status === 'active')) {\n  throw new Error('No active SSO settings; configure SSO before PingOne login.');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await pingOneRecoverLogin();\n} catch (e) {\n  if (e.message === 'The SSO settings do not exist.') {\n    redirectToStandardRecover();\n  } else throw e;\n}","preventionTips":["Activate SSO settings before exposing SSO endpoints to users","Verify settings survive environment restores/backups","Check active settings at app startup or route guard level","Fall back to standard recover endpoints when SSO is unconfigured"],"tags":["sso","configuration","missing-settings","pingone"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}