passbolt/passbolt_api · critical · InternalErrorException

Could not update the SSO settings.

Error message

Could not update the SSO settings.

What it means

Thrown when persisting the activated SSO settings (setting status to active, modified_by) or deleting all other settings fails with a generic exception inside SsoSettingsActivateService::activate(). It wraps the original exception as an InternalErrorException (500), indicating a server-side persistence problem rather than invalid input.

Solutions

1. Inspect the wrapped previous exception in the server logs for the root cause
2. Run pending migrations (bin/cake migrations_run / ddev refresh) to fix schema drift
3. Retry activation once the database is healthy; verify the acting user still exists

try { $service->activate($uac, $id, $data); } catch (InternalErrorException $e) { Log::error($e->getPrevious()); // alert/retry }

When it happens

Trigger: Database failure during SsoSettings->save(), a validation error on the entity (e.g. modified_by id invalid), or an exception from SsoSettingsDeleteService::deleteAllBut() during activation.

Common situations: Database connection loss or lock timeouts mid-request; schema drift after an incomplete migration; modified_by pointing to a deleted user; concurrent activation races deleting the same rows.

Related errors

• Could not delete the draft SSO settings.
• Could not delete the SSO settings.
• Could not delete the role, please try again later.
• Could not save the role, please try again later.
• Could not save the SSO state, please try again later.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/b49bfae6d35e18b7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsActivateService.php:97

        // If token is not found remap error, not found in this context is reserved for settings
        try {
            $ssoAuthToken = $authTokenService->getOrFail($data['token'] ?? '', $type);
        } catch (RecordNotFoundException $exception) {
            throw new BadRequestException($exception->getMessage(), 400, $exception);
        }

        // Consume or be consumed
        $authTokenService->assertAndConsume($ssoAuthToken, $uac, $ssoSettingEntity->id);

        // Activate
        try {
            $ssoSettingEntity->status = SsoSetting::STATUS_ACTIVE;
            $ssoSettingEntity->modified_by = $uac->getId();
            $this->SsoSettings->save($ssoSettingEntity);
            (new SsoSettingsDeleteService())->deleteAllBut($id);
        } catch (Exception $exception) {
            throw new InternalErrorException(__('Could not update the SSO settings.'), 500, $exception);
        }

        // Notify settings have been changed
        $event = new Event(
            self::AFTER_ACTIVATE_SSO_SETTINGS_EVENT,
            $this,
            ['uac' => $uac, 'ssoSetting' => $ssoSettingEntity]
        );
        $this->SsoSettings->getEventManager()->dispatch($event);

        // Return new updated setting
        return (new SsoSettingsGetService())->getActiveOrFail(true);
    }

    /**
     * @param string $id uuid
     * @param string $status for example SsoSetting::STATUS_ACTIVE
     * @throws \Cake\Http\Exception\BadRequestException if the settings id is not a uuid

View on GitHub (pinned to 31c1bbc10f)