{"record":{"id":"97c340742e72b7a5","repo":"passbolt/passbolt_api","slug":"the-user-id-is-invalid-abstractssocontroller","errorCode":null,"errorMessage":"The user id is invalid.","messagePattern":"The user id is invalid\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Controller/AbstractSsoController.php","lineNumber":208,"sourceCode":"        $settingsId = $this->request->getData('sso_settings_id');\n        if (!isset($settingsId) || !is_string($settingsId)) {\n            throw new BadRequestException(__('The settings id is required in URL parameters.'));\n        }\n\n        return $settingsId;\n    }\n\n    /**\n     * Get an extended user access control from a user id and request client info\n     *\n     * @param string $userId uuid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the userid is not valid or user does not exist or is inactive\n     * @return \\App\\Utility\\ExtendedUserAccessControl\n     */\n    public function getUacFromUserIdAndRequest(string $userId): ExtendedUserAccessControl\n    {\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user id is invalid.'));\n        }\n\n        try {\n            $user = (new UserGetService())->getActiveNotDeletedNotDisabledOrFail($userId);\n        } catch (NotFoundException $exception) {\n            throw new BadRequestException(__('The user does not exist or is not active.'), 400, $exception);\n        }\n\n        return new ExtendedUserAccessControl(\n            Role::GUEST,\n            $user->id,\n            $user->username,\n            $this->User->ip(),\n            $this->User->userAgent()\n        );\n    }\n\n    /**","sourceCodeStart":190,"sourceCodeEnd":226,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Controller/AbstractSsoController.php#L190-L226","documentation":"Thrown by getUacFromUserIdAndRequest() when the provided user_id fails CakePHP's Validation::uuid() check. The API requires a valid UUID v4-formatted user identifier before it will even look up the user. This is a cheap input-format guard ahead of the database lookup.","triggerScenarios":"Calling stage1 with 'user_id' set to a non-UUID string such as 'me', 'admin@example.com', a numeric id, or a truncated/malformed uuid.","commonSituations":"Client passes the username or email instead of the user uuid; id came from an older database with integer keys; string got truncated or altered in transit (e.g. URL encoding bug).","solutions":["Ensure user_id is a proper 36-character UUID (e.g. fetched from the users API)","Replace any usage of email/username with the user's uuid field","Trim whitespace and re-encode the value; check for truncation in client-side storage","Validate client-side with a UUID regex before sending"],"exampleFix":"// before\nbody: {user_id: 'admin@company.com'}\n// after\nbody: {user_id: '52f3f602-eef0-4c6b-b6c4-c5d3b1a1e0aa'}","handlingStrategy":"validation","validationCode":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nif (!UUID_RE.test(userId)) throw new Error('user_id must be a valid UUID');","typeGuard":"function isUuid(v: unknown): v is string {\n  return typeof v === 'string' && /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(v);\n}","tryCatchPattern":"try {\n  await startSsoStage1({user_id});\n} catch (e) {\n  if (e.response?.status === 400 && e.response?.data?.message?.includes('user id is invalid')) {\n    // re-fetch the correct user uuid from the users API\n  }\n}","preventionTips":["Never send usernames or emails where a uuid is expected","Validate uuid format client-side before every API call","Fetch user ids from the users list endpoint rather than manual input"],"tags":["sso","validation","uuid"],"backgroundTag":"invalid-identifier-format","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}