passbolt/passbolt_api · error · BadRequestException

Access to this service requires an invitation. Please…

Error message

Access to this service requires an invitation. Please contact your administrator to request an invitation link.

What it means

After SSO authentication, passbolt checks via SelfRegistrationEmailDomainsDryRunService whether the provider-supplied email's domain is permitted for guest self-registration. If canGuestSelfRegister throws CustomValidationException or ForbiddenException (domain not allowed / self-registration off), the user is told they need an invitation.

Solutions

1. Add the user's email domain in Admin Workspace > Self Registration settings (or use the API to update allowed domains)
2. Invite the user manually via Users > Invite so they get an invitation link
3. Ask the user to sign in with an account on an allowed domain
4. Verify the dry-run domain configuration matches the domain the IdP sends

Example fix

// before: allowed domains = ['example.com'], user logs in as alice@other-company.com
// after (admin adds domain)
PUT /selfregistration/settings.jsonapi
{"providers": {"emailDomain": {"allowedDomains": ["example.com", "other-company.com"]}}}

const domain = email.split('@')[1];
const allowed = await fetch('/selfregistration/settings.jsonapi').then(r => r.json());
const domains = allowed.data?.providers?.emailDomain?.allowedDomains ?? [];
if (!domains.includes(domain)) console.warn('Domain not allowed, user needs an invitation');

try {
  await startSsoRecover();
} catch (e) {
  if (String(e.message).includes('requires an invitation')) {
    redirectToInviteRequestForm();
  } else { throw e; }
}

When it happens

Trigger: A user authenticates successfully with the SSO provider but their email domain is not in the self-registration allowed-domains list; self-registration is set to invite-only.

Common situations: Employees of a newly acquired company with a different email domain; personal Google accounts used against a corporate SSO setup; admin recently restricted the allowed domains list; user email domain typo in admin settings.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Ajax/Json request not supported.
• SSO settings edit endpoints are disabled.
• The user does not exist or has been deleted.
• Access restricted to administrators.
• AccessToken should be an instance of BaseIdToken class.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/264638cfca08050b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Service/SsoRecoverAssertService.php:130

     * @throws \Cake\Http\Exception\BadRequestException When email domain is not allowed.
     * @throws \Cake\Http\Exception\BadRequestException When email domains doesn't exist.
     */
    private function isAllowedForSelfRegister(SsoResourceOwnerInterface $resourceOwner): void
    {
        if (!$this->isFeaturePluginEnabled('SelfRegistration')) {
            throw new BadRequestException(__('The user does not exist or has been deleted.'));
        }

        $selfRegistrationService = new SelfRegistrationEmailDomainsDryRunService();
        $data = ['email' => $resourceOwner->getEmail()];

        try {
            $selfRegistrationService->canGuestSelfRegister($data);
        } catch (CustomValidationException | ForbiddenException $e) {
            $msg = __('Access to this service requires an invitation. ');
            $msg .= __('Please contact your administrator to request an invitation link.');

            throw new BadRequestException($msg, null, $e);
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)