{"record":{"id":"cec72fcff73f46cd","repo":"passbolt/passbolt_api","slug":"the-authentication-token-does-not-exist-cec72f","errorCode":null,"errorMessage":"The authentication token does not exist.","messagePattern":"The authentication token does not exist\\.","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsActivateService.php","lineNumber":84,"sourceCode":"    {\n        // User must be an admin\n        $uac->assertIsAdmin();\n\n        // Trying to activate the settings\n        $this->assertActiveStatus($data);\n\n        // Status must in draft status\n        $ssoSettingEntity = $this->assertAndGetSettings($id, SsoSetting::STATUS_DRAFT);\n\n        // Token must be provided and matching the settings, user id, ip, user agent, etc.\n        $authTokenService = new SsoAuthenticationTokenGetService();\n        $type = SsoState::TYPE_SSO_SET_SETTINGS;\n\n        // If token is not found remap error, not found in this context is reserved for settings\n        try {\n            $ssoAuthToken = $authTokenService->getOrFail($data['token'] ?? '', $type);\n        } catch (RecordNotFoundException $exception) {\n            throw new BadRequestException($exception->getMessage(), 400, $exception);\n        }\n\n        // Consume or be consumed\n        $authTokenService->assertAndConsume($ssoAuthToken, $uac, $ssoSettingEntity->id);\n\n        // Activate\n        try {\n            $ssoSettingEntity->status = SsoSetting::STATUS_ACTIVE;\n            $ssoSettingEntity->modified_by = $uac->getId();\n            $this->SsoSettings->save($ssoSettingEntity);\n            (new SsoSettingsDeleteService())->deleteAllBut($id);\n        } catch (Exception $exception) {\n            throw new InternalErrorException(__('Could not update the SSO settings.'), 500, $exception);\n        }\n\n        // Notify settings have been changed\n        $event = new Event(\n            self::AFTER_ACTIVATE_SSO_SETTINGS_EVENT,","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsActivateService.php#L66-L102","documentation":"SsoSettingsActivateService::activate() first verifies the draft SSO activation token exists via the auth token service, using type TYPE_SSO_SET_SETTINGS. If getOrFail() raises RecordNotFoundException, the error is deliberately remapped to a BadRequestException (400) instead of 404, because 'not found' is reserved for the settings themselves in this context.","triggerScenarios":"Calling activate() with a missing, deleted, or wrong-type token in $data['token'] (or omitting the key entirely — '' is then looked up and not found). Any token not of type sso_set_settings also misses.","commonSituations":"Reusing an already-consumed activation token after a prior activation attempt; copying the draft settings id instead of the token; expired/purged auth tokens; hitting activate twice from a stale browser tab.","solutions":["Pass the correct, unconsumed token returned when the draft SSO settings were created","Ensure the token is fetched from the SSO draft settings creation flow, not from another token type","Re-create the draft SSO settings to generate a fresh token if it was consumed or purged"],"exampleFix":"// before\n$service->activate($uac, $settingId, ['status' => 'active']); // token missing\n// after\n$service->activate($uac, $settingId, ['token' => $draftToken, 'status' => 'active']);","handlingStrategy":"try-catch","validationCode":"if (empty($data['token']) || !is_string($data['token'])) { throw new \\InvalidArgumentException('A valid activation token is required'); }","typeGuard":null,"tryCatchPattern":"try { $service->activate($uac, $id, $data); } catch (BadRequestException $e) { // token missing/consumed: regenerate draft token }","preventionTips":["Always take the token from the draft creation response","Never reuse a token after a successful activation","Keep draft settings and token together in client state"],"tags":["sso","auth-token","bad-request","passbolt"],"backgroundTag":"record-not-found","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}