{"record":{"id":"f574d88354f82777","repo":"passbolt/passbolt_api","slug":"scim-settings-endpoints-are-disabled","errorCode":null,"errorMessage":"SCIM settings endpoints are disabled.","messagePattern":"SCIM settings endpoints are disabled\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltEe/Scim/src/Middleware/ScimSettingsSecurityMiddleware.php","lineNumber":41,"sourceCode":"use Psr\\Http\\Server\\MiddlewareInterface;\nuse Psr\\Http\\Server\\RequestHandlerInterface;\n\nclass ScimSettingsSecurityMiddleware implements MiddlewareInterface\n{\n    public const PASSBOLT_SECURITY_SCIM_SETTINGS_ENDPOINTS_DISABLED =\n        'passbolt.security.scim.settings.endpointsDisabled';\n\n    /**\n     * @param \\Psr\\Http\\Message\\ServerRequestInterface $request The request.\n     * @param \\Psr\\Http\\Server\\RequestHandlerInterface $handler The handler.\n     * @return \\Psr\\Http\\Message\\ResponseInterface The response.\n     */\n    public function process(\n        ServerRequestInterface $request,\n        RequestHandlerInterface $handler\n    ): ResponseInterface {\n        if (Configure::read(self::PASSBOLT_SECURITY_SCIM_SETTINGS_ENDPOINTS_DISABLED)) {\n            throw new ForbiddenException(__('SCIM settings endpoints are disabled.'));\n        }\n\n        return $handler->handle($request);\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":47,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltEe/Scim/src/Middleware/ScimSettingsSecurityMiddleware.php#L23-L47","documentation":"This ForbiddenException is raised by ScimSettingsSecurityMiddleware when the Configure flag passbolt.security.scim.settings.endpointsDisabled is set to a truthy value. It is a kill-switch that lets instance administrators hard-disable all SCIM settings management endpoints (creating/updating/deleting SCIM configurations) while leaving SCIM provisioning itself unaffected. The middleware short-circuits the request before the handler runs.","triggerScenarios":"Any HTTP call to the SCIM settings endpoints (GET/POST/PUT/DELETE on /scim/v2/settingId.json routes) while the config key 'passbolt.security.scim.settings.endpointsDisabled' is truthy - typically because passbolt.php or config/scim.php sets 'security' => ['scim' => ['settings' => ['endpointsDisabled' => true]]].","commonSituations":"Hardened production deployments where the SCIM config was set once out-of-band and admins now wonder why the API returns 403; stale configuration copied from a security-hardening guide; attempting to manage SCIM settings via API on an instance where the admin policy requires CLI-based configuration.","solutions":["If the endpoints should be available, remove or set to false the 'passbolt.security.scim.settings.endpointsDisabled' key in config/passbolt.php and clear the config cache","Verify the current value before calling the API by inspecting your configuration files (grep for endpointsDisabled)","If disabling is intentional, manage SCIM settings through alternative means (CLI or direct provisioning) instead of the HTTP API","Confirm with your instance administrator that the flag was deliberately set before changing it, as it may be part of a security policy"],"exampleFix":"// before (config/passbolt.php)\n'security' => [\n    'scim' => ['settings' => ['endpointsDisabled' => true]],\n],\n\n// after\n'security' => [\n    'scim' => ['settings' => ['endpointsDisabled' => false]],\n],","handlingStrategy":"validation","validationCode":"// check config before calling\n$enabled = !Configure::read('passbolt.security.scim.settings.endpointsDisabled');\nif (!$enabled) { /* skip settings API calls */ }","typeGuard":"function isScimSettingsEnabled(config: { passbolt?: { security?: { scim?: { settings?: { endpointsDisabled?: boolean } } } } }): boolean {\n  return config.passbolt?.security?.scim?.settings?.endpointsDisabled !== true;\n}","tryCatchPattern":"try {\n  const res = await fetch('/scim/v2/settingId.json', opts);\n  if (res.status === 403) throw new ScimSettingsDisabledError();\n} catch (e) { /* fall back to CLI/direct config management */ }","preventionTips":["Keep SCIM security flags documented in your deployment config and review them before API integrations","Query settings endpoints' availability (or healthcheck) before relying on them in automation","Avoid copy-pasting hardened passbolt.php snippets wholesale from guides","Align with instance admins on which SCIM endpoints are intentionally disabled"],"tags":["scim","configuration","http","feature-flag","forbidden"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}