{"record":{"id":"b2ecddce46d980cd","repo":"passbolt/passbolt_api","slug":"directory-sync-settings-endpoints-are-disabled","errorCode":null,"errorMessage":"Directory sync settings endpoints are disabled.","messagePattern":"Directory sync settings endpoints are disabled\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltEe/DirectorySync/src/Middleware/DirectorySyncEndpointsSecurityMiddleware.php","lineNumber":38,"sourceCode":"use Cake\\Http\\Exception\\ForbiddenException;\nuse Psr\\Http\\Message\\ResponseInterface;\nuse Psr\\Http\\Message\\ServerRequestInterface;\nuse Psr\\Http\\Server\\MiddlewareInterface;\nuse Psr\\Http\\Server\\RequestHandlerInterface;\n\nclass DirectorySyncEndpointsSecurityMiddleware implements MiddlewareInterface\n{\n    public const SECURITY_CONFIG_KEY = 'passbolt.security.directorySync.endpointsDisabled';\n\n    /**\n     * @param \\Psr\\Http\\Message\\ServerRequestInterface $request The request.\n     * @param \\Psr\\Http\\Server\\RequestHandlerInterface $handler The handler.\n     * @return \\Psr\\Http\\Message\\ResponseInterface The response.\n     */\n    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface\n    {\n        if (Configure::read(self::SECURITY_CONFIG_KEY)) {\n            throw new ForbiddenException(__('Directory sync settings endpoints are disabled.'));\n        }\n\n        return $handler->handle($request);\n    }\n}\n","sourceCodeStart":20,"sourceCodeEnd":44,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/DirectorySync/src/Middleware/DirectorySyncEndpointsSecurityMiddleware.php#L20-L44","documentation":"ForbiddenException raised by DirectorySyncEndpointsSecurityMiddleware::process() when the Configure flag at self::SECURITY_CONFIG_KEY (passbolt security setting disabling directory sync endpoints) is truthy. The middleware blocks all directory sync settings endpoints at the HTTP layer before controllers run.","triggerScenarios":"Any request to /directorysync/* endpoints while the security flag is enabled, e.g. passbolt.security.directorySyncEndpoints disabled in config, typically set deliberately via environment/config to harden a production instance.","commonSituations":"Fresh deployments with the hardening flag enabled by default; teams enabling endpoints for LDAP setup then forgetting to disable the flag again — or conversely, hitting this flag in a local dev environment; config file not loaded for the expected environment.","solutions":["Set the security flag to false in config (e.g. passbolt.php or environment variable) to re-enable the endpoints","Check which environment's config is actually loaded (app.default.php vs passbolt.php overrides)","Only disable the flag while configuring LDAP, and re-enable it afterwards to keep the hardening","If endpoints must stay locked, manage directory sync via CLI commands instead of the HTTP API"],"exampleFix":"// before: endpoints disabled\n'security' => ['directorySyncEndpoints' => true]\n// after: endpoints enabled\n'security' => ['directorySyncEndpoints' => false]","handlingStrategy":"validation","validationCode":"// detect whether directory sync endpoints are disabled before calling\nconst enabled = await api.get('/directorysync/settings').catch(e => e.status !== 403);\nif (!enabled) throw new Error('Directory sync endpoints are disabled by security config');","typeGuard":"null","tryCatchPattern":"try {\n    await api.get('/directorysync/settings');\n} catch (e) {\n    if (e.status === 403 && e.message.includes('endpoints are disabled')) {\n        alertOps('Enable passbolt security.directorySyncEndpoints to use this endpoint');\n    }\n}","preventionTips":["Document the security flag state for each environment (dev vs production)","Enable endpoints only during LDAP setup, then re-enable the hardening","Use CLI commands when endpoints are intentionally locked","Confirm which config file/environment is loaded when flags behave unexpectedly"],"tags":["middleware","forbidden","security-config","directory-sync"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}