{"record":{"id":"bcdc4df611a6c6c8","repo":"passbolt/passbolt_api","slug":"the-sso-setting-cannot-be-decrypted","errorCode":null,"errorMessage":"The SSO setting cannot be decrypted.","messagePattern":"The SSO setting cannot be decrypted\\.","errorType":"http","errorClass":"InternalErrorException","httpStatus":500,"severity":"critical","filePath":"plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsGetService.php","lineNumber":166,"sourceCode":"        $passphrase = Configure::read('passbolt.gpg.serverKey.passphrase');\n\n        try {\n            $gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n        } catch (Exception $exception) {\n            try {\n                $gpg->importServerKeyInKeyring();\n                $gpg->setDecryptKeyFromFingerprint($fingerprint, $passphrase);\n            } catch (Exception $exception) {\n                $msg = __('The OpenPGP server key defined in the config cannot be used to decrypt.') . ' ';\n                $msg .= $exception->getMessage();\n                throw new InternalErrorException($msg, 500, $exception);\n            }\n        }\n\n        try {\n            $decryptedData = $gpg->decrypt($data);\n        } catch (Exception $exception) {\n            throw new InternalErrorException(__('The SSO setting cannot be decrypted.'), 500, $exception);\n        }\n\n        $decodedData = json_decode($decryptedData, true);\n        if (!isset($decodedData) || !is_array($decodedData)) {\n            throw new InternalErrorException(__('The SSO setting cannot be decoded.'));\n        }\n\n        return $decodedData;\n    }\n}\n","sourceCodeStart":148,"sourceCodeEnd":177,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsGetService.php#L148-L177","documentation":"decrypt() successfully set up the key but the call to $gpg->decrypt($data) on the stored, encrypted SSO settings payload failed; the exception is wrapped as InternalErrorException 'The SSO setting cannot be decrypted.' This means the data column cannot be turned back into plaintext JSON with the currently configured server key.","triggerScenarios":"The sso_settings.data was encrypted with a different server key than the one now configured (e.g. server key rotated or host migrated); the encrypted blob is corrupted or truncated; database content mangled by a bad migration/import (encoding issues).","commonSituations":"Restoring a database backup onto a server whose OpenPGP server key differs from the one that encrypted the rows; upgrading/moving passbolt without migrating the server key keyring; charset conversion corrupting binary data in the DB.","solutions":["Restore the original server key (fingerprint + private key + passphrase) that encrypted the data, then retry.","Check the appended previous exception message from gnupg for the precise decrypt failure cause.","Delete and re-create the SSO settings if the data is unrecoverable (settings can be re-entered).","Verify no DB migration/import altered the data column encoding (use binary-safe transport, e.g. --hex-blob for mysqldump)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { $dto = $service->getByIdOrFail($id, true); } catch (InternalErrorException $e) { if (str_contains($e->getMessage(), 'cannot be decrypted')) { // recover old server key or re-create settings } }","preventionTips":["Always migrate the GPG server key when moving/restoring to another host","Back up the server key keyring together with the database","Avoid charset-converting dumps containing encrypted binary data (use --hex-blob)","Re-create SSO settings if the original key is lost"],"tags":["gpg","sso","decryption","data-corruption"],"backgroundTag":"checksum-mismatch","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}