{"record":{"id":"b1df87331548d0e5","repo":"passbolt/passbolt_api","slug":"missing-or-invalid-scim-user-in-configuration-settings","errorCode":null,"errorMessage":"Missing or invalid SCIM user in configuration settings","messagePattern":"Missing or invalid SCIM user in configuration settings","errorType":"exception","errorClass":"Passbolt\\Scim\\Exception\\ConflictException","httpStatus":409,"severity":"critical","filePath":"plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php","lineNumber":360,"sourceCode":"                    'The %s resource could not be created due to a uniqueness conflict',\n                    $this->getType()\n                ),\n                scimType: ScimException::SCIM_TYPE_UNIQUENESS,\n            );\n        }\n    }\n\n    /**\n     * Register a brand-new user via the Users table.\n     *\n     * @return \\App\\Model\\Entity\\User\n     * @throws \\Passbolt\\Scim\\Exception\\ConflictException\n     */\n    private function registerNewUser(): User\n    {\n        $scimUser = $this->getScimSettingsSelectedUser();\n        if (!$scimUser) {\n            throw new ConflictException(__('Missing or invalid SCIM user in configuration settings'));\n        }\n\n        $uac = new UserAccessControl($scimUser->role->name, $scimUser->id);\n\n        try {\n            return $this->Users->register([\n                'username' => $this->email,\n                'disabled' => $this->getDisabledValue($this->active),\n                'profile' => [\n                    'first_name' => $this->firstName,\n                    'last_name' => $this->lastName,\n                ],\n            ], $uac);\n        } catch (ValidationException $exception) {\n            throw new ConflictException(\n                $this->getValidationErrorMessage($exception->getEntity()),\n                scimType: ScimException::SCIM_TYPE_INVALID_VALUE\n            );","sourceCodeStart":342,"sourceCodeEnd":378,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php#L342-L378","documentation":"This ConflictException is thrown by registerNewUser() when the SCIM settings do not reference a valid acting user. Creating a passbolt user requires a UserAccessControl built from the configured scim_user_id; if the setting is missing or the referenced user no longer exists, registration is aborted.","triggerScenarios":"POST /scim/v2/Users for a brand-new user while passbolt SCIM settings have an empty/missing scim_user_id, or the configured scim_user_id points to a deleted or non-existent user.","commonSituations":"SCIM enabled but the setup step that picks the acting SCIM admin user was skipped; the designated SCIM user was deleted or deactivated; database restored without the settings row; settings encrypted payload lost scim_user_id.","solutions":["Re-save SCIM settings (PUT /scim/v2/settings) ensuring a valid scim_user_id is set, or run the SCIM setup command","Verify the user id in scim_settings exists in the users table and has a role (loadInto includes Roles)","Check logs for ScimGetSettingsService failures indicating decryption/settings issues"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"$settings = (new \\Passbolt\\Scim\\Service\\ScimGetSettingsService())->getSettingsDecryptedValue();\nif (empty($settings['scim_user_id'])) {\n    throw new RuntimeException('SCIM is not fully configured: scim_user_id missing.');\n}\n$user = TableRegistry::getTableLocator()->get('Users')\n    ->find()->contain(['Roles'])->where(['id' => $settings['scim_user_id']])->first();\nif (!$user) {\n    throw new RuntimeException('Configured SCIM user does not exist.');\n}","typeGuard":null,"tryCatchPattern":"try {\n    $scimUsers->create();\n} catch (\\Passbolt\\Scim\\Exception\\ConflictException $e) {\n    if ($e->getMessage() === 'Missing or invalid SCIM user in configuration settings') {\n        // re-run SCIM setup: re-save settings with a valid scim_user_id\n    }\n}","preventionTips":["Complete SCIM setup (selecting the acting SCIM user) before enabling IdP provisioning","Add a health check that validates scim_user_id points to an active user with a role","Exclude the SCIM provisioning user from deletion policies"],"tags":["scim","configuration","missing-user"],"backgroundTag":"missing-config-value","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}