{"record":{"id":"bcf6db156e36ece0","repo":"passbolt/passbolt_api","slug":"registration-is-not-opened-to-public-please-contact-your","errorCode":null,"errorMessage":"Registration is not opened to public. Please contact your administrator.","messagePattern":"Registration is not opened to public\\. Please contact your administrator\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\NotFoundException","httpStatus":404,"severity":"warning","filePath":"src/Controller/Users/UsersRegisterController.php","lineNumber":110,"sourceCode":"        // Assert that the user can self register, based on the payload and the self registration settings\n        $dryRunService->canGuestSelfRegister(['email' => $this->getRequest()->getData('username')]);\n\n        $user = $userRegisterService->register();\n\n        $this->success(__('The operation was successful.'), $user);\n    }\n\n    /**\n     * @param \\Passbolt\\SelfRegistration\\Service\\DryRun\\SelfRegistrationDryRunServiceInterface $dryRunService dry run service\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the user cannot register\n     */\n    protected function assertIsSelfRegistrationOpen(SelfRegistrationDryRunServiceInterface $dryRunService): void\n    {\n        if (!$dryRunService->isSelfRegistrationOpen()) {\n            $msg = __('Registration is not opened to public.') . ' ';\n            $msg .= __('Please contact your administrator.');\n            throw new NotFoundException($msg);\n        }\n        if (Configure::read(UsersRecoverController::PREVENT_EMAIL_ENUMERATION_CONFIG_KEY)) {\n            $msg = __('Registration is not opened to public.') . ' ';\n            $msg .= __('This is due to a security setting.') . ' ';\n            $msg .= __('Please contact your administrator.');\n            throw new NotFoundException($msg);\n        }\n    }\n}\n","sourceCodeStart":92,"sourceCodeEnd":120,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Users/UsersRegisterController.php#L92-L120","documentation":"UsersRegisterController::assertIsSelfRegistrationOpen throws this NotFoundException when the configured self-registration settings are not open: either SelfRegistrationDryRunServiceInterface::isSelfRegistrationOpen() returns false, or the passbolt prevent-email-enumeration security setting is enabled. In both cases public registration is intentionally disabled and the controller pretends the page does not exist (404).","triggerScenarios":"GET /users/register or POST /users/register.json when (a) no self-registration provider is configured in passbolt (e.g. no email-domain rule set), or (b) the passbolt.security.prevent-email-enumeration config flag is true, which disables public registration to avoid leaking whether registration is available.","commonSituations":"Fresh passbolt instance where admins never configured self-registration settings; instance with prevent-email-enumeration enabled (common in hardened/enterprise setups); environment config drift between staging (open) and production (closed); caller code assuming registration is always available.","solutions":["Have an administrator open self-registration: configure the self-registration settings (e.g. allowed email domains) via the administration UI or `passbolt self_registration` command.","Check whether passbolt.security.prevent-email-enumeration is set to true in config and, if public registration is desired, disable it after assessing the trade-off.","Call GET /users/register (or the dry-run service) to probe whether registration is open before submitting payloads.","If registration is intentionally closed, use admin-initiated user creation (POST /users.json as admin) instead."],"exampleFix":"// before\nawait client.post('/users/register.json', payload);\n// after\nconst open = await dryRunService.isSelfRegistrationOpen();\nif (open) {\n  await client.post('/users/register.json', payload);\n} else {\n  console.warn('Self-registration disabled; contact administrator');\n}","handlingStrategy":"validation","validationCode":"// probe availability before submitting\nconst res = await fetch('/users/register');\nif (res.status === 404) {\n  console.warn('Self-registration is closed on this instance');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await api.post('/users/register.json', payload);\n} catch (e) {\n  if (e.status === 404 && /not opened to public/.test(e.message)) {\n    // fall back to admin-created account or contact administrator\n  }\n}","preventionTips":["Configure self-registration settings (allowed email domains) before relying on public signup.","Check the prevent-email-enumeration security flag; it intentionally disables public registration.","Probe GET /users/register or the dry-run service before POSTing registration payloads.","Use admin user creation (POST /users.json) on instances where registration is closed."],"tags":["http-404","registration","configuration","self-registration"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}