{"record":{"id":"90979b9fcdbdb289","repo":"passbolt/passbolt_api","slug":"sso-settings-edit-endpoints-are-disabled","errorCode":null,"errorMessage":"SSO settings edit endpoints are disabled.","messagePattern":"SSO settings edit endpoints are disabled\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Middleware/SsoEndpointsSecurityMiddleware.php","lineNumber":38,"sourceCode":"use Cake\\Http\\Exception\\ForbiddenException;\nuse Psr\\Http\\Message\\ResponseInterface;\nuse Psr\\Http\\Message\\ServerRequestInterface;\nuse Psr\\Http\\Server\\MiddlewareInterface;\nuse Psr\\Http\\Server\\RequestHandlerInterface;\n\nclass SsoEndpointsSecurityMiddleware implements MiddlewareInterface\n{\n    public const SECURITY_CONFIG_KEY = 'passbolt.security.sso.settings.editionDisabled';\n\n    /**\n     * @param \\Psr\\Http\\Message\\ServerRequestInterface $request The request.\n     * @param \\Psr\\Http\\Server\\RequestHandlerInterface $handler The handler.\n     * @return \\Psr\\Http\\Message\\ResponseInterface The response.\n     */\n    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface\n    {\n        if (Configure::read(self::SECURITY_CONFIG_KEY)) {\n            throw new ForbiddenException(__('SSO settings edit endpoints are disabled.'));\n        }\n\n        return $handler->handle($request);\n    }\n}\n","sourceCodeStart":20,"sourceCodeEnd":44,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Middleware/SsoEndpointsSecurityMiddleware.php#L20-L44","documentation":"The SSO endpoints security middleware hard-blocks SSO settings edit endpoints when the Configure flag passbolt.security.sso.settings.endpoints.disabled (SECURITY_CONFIG_KEY) is truthy. Any request routed through the middleware is rejected with ForbiddenException regardless of authentication.","triggerScenarios":"Any POST/PUT/DELETE to SSO settings CRUD endpoints while the disable flag is set in config (e.g. set via environment variable PASSBOLT_SECURITY_SSO_SETTINGS_ENDPOINTS_DISABLED=true or config file).","commonSituations":"Instance hardened for production where SSO settings must be edited via CLI/healthcheck only; operators forgot the flag is enabled when trying to configure SSO in the UI; self-hosted instances upgrading after the security option was introduced.","solutions":["Disable SSO edits via UI is intended: configure SSO using the CLI command (passbolt sso_settings) instead of HTTP endpoints","Remove/unset the security config flag (e.g. PASSBOLT_SECURITY_SSO_SETTINGS_ENDPOINTS_DISABLED=false) and restart, if HTTP editing is desired","Verify the flag value with `passbolt sso_settings dump` or inspect config/passbolt.php and environment"],"exampleFix":"// before (config/passbolt.php)\n'security' => ['sso' => ['settings' => ['endpoints' => ['disabled' => true]]]],\n// after\n'security' => ['sso' => ['settings' => ['endpoints' => ['disabled' => false]]]],","handlingStrategy":"validation","validationCode":"if (Configure::read('passbolt.security.sso.settings.endpoints.disabled')) {\n    // edit endpoints blocked; use CLI instead\n}","typeGuard":null,"tryCatchPattern":"try {\n    $response = $api->put('/sso/settings/' . $id, $payload);\n} catch (ClientException $e) {\n    if ($e->getResponse()->getStatusCode() === 403) {\n        // fall back to `passbolt sso_settings` CLI\n    }\n}","preventionTips":["Check the security flag before attempting HTTP-based SSO settings edits","Document that hardened instances require CLI configuration","Audit config/passbolt.php and env vars for the disable flag"],"tags":["sso","forbidden","security-config","middleware"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}