passbolt/passbolt_api · error · ValidationException

Could not validate user data.

Error message

Could not validate user data.

What it means

UserSyncAction::updateUser edits the existing user entity via UsersTable::editEntity with admin access control and saves it with checkrules=false; when the save fails and the entity carries validation errors, it wraps them in a ValidationException with the message 'Could not validate user data.' The entity's error set (attached to the exception) holds the per-field reasons. This corresponds to LDAP/AD directory data conflicting with passbolt's user validation rules.

Solutions

1. Inspect the ValidationException's entity errors (getEntity()->getErrors()) to see exactly which fields failed, then fix the corresponding data in the directory or the mapping config.
2. Check for duplicate emails/usernames in the users table conflicting with the LDAP entry and resolve the collision (merge, rename, or deactivate the stale account).
3. Correct the DirectorySync email/attribute mapping configuration so valid LDAP attributes feed username/first_name/last_name.
4. If a legitimate edit is being blocked by field-level protection, perform it through the proper flow (e.g. admin UI) instead of sync, or adjust the data so it passes validation.
5. Catch ValidationException in the sync report layer so one bad user does not abort the whole directory sync run, and record the field errors in the ActionReport.

Example fix

// before
$result = $this->Users->save($user, ['checkrules' => false]);
// after
$result = $this->Users->save($user, ['checkrules' => false]);
if (!$result) {
    if ($user->hasErrors()) {
        $errors = $user->getErrors(); // e.g. ['username' => ['_isUnique' => 'The username is already used.']]
        $this->addReportItem(ActionReport::ERROR, 'The user data could not be validated.', json_encode($errors));
        return; // skip user, continue sync
    }
    throw new Exception('User could not be updated.');
}

use Cake\Validation\Validation;
if (!Validation::email($data['username'] ?? '')) {
    // fix or skip this directory entry before attempting the edit
}
$conflict = $usersTable->find()->where(['username' => $data['username'], 'id !=' => $existingUser->id])->first();
if ($conflict !== null) { /* resolve duplicate username/email before sync */ }

try {
    $user = $this->Users->editEntity($existingUser, $data, new UserAccessControl(Role::ADMIN));
    $this->Users->save($user, ['checkrules' => false]);
} catch (ValidationException $e) {
    $fieldErrors = $e->getEntity()->getErrors();
    $this->addReportItem(ActionReport::ERROR, 'User data validation failed', json_encode($fieldErrors));
}

When it happens

Trigger: Directory sync updating a user where the incoming data violates model rules: invalid email format, username already taken by another account, too-short profile fields, role changes to a protected value, or editEntity's access-control rules rejecting the modification (e.g. editing hard-protected fields or a deactivated admin).

Common situations: Active Directory entries with emails passbolt considers invalid or duplicated (two LDAP users mapped to one passbolt email), renamed accounts colliding with existing usernames, sync configurations mapping wrong LDAP attributes (mail vs userPrincipalName) into user fields, or attempts to modify users that passbolt rules forbid changing during sync.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• group(s) returned by your directory are invalid and will be…
• users returned by your directory are invalid and will be…
• Could not validate directory entry data.
• $exception->getMessage()
• $message

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/091533418d4134a6. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Actions/UserSyncAction.php:142

    }

    /**
     * Update user
     *
     * @param \App\Model\Entity\User $existingUser User
     * @param array $data data
     * @return void
     */
    private function updateUser(User $existingUser, array $data): void
    {
        try {
            $user = $this->Users->editEntity($existingUser, $data, new UserAccessControl(Role::ADMIN));
            $result = $this->Users->save($user, ['checkrules' => false]);

            if (!$result) {
                if ($user->hasErrors()) {
                    $msg = __('Could not validate user data.');
                    throw new ValidationException($msg, $user, $this->Users);
                }
                throw new Exception('User could not be updated.');
            }
            // Send report.
            $this->addReportItem(new ActionReport(
                __(
                    'The user {0} full name has been successfully updated to {1} {2}.',
                    $existingUser->username,
                    $user->profile->first_name,
                    $user->profile->last_name
                ),
                Alias::MODEL_USERS,
                Alias::ACTION_UPDATE,
                Alias::STATUS_SUCCESS,
                $user
            ));
        } catch (Exception $exception) {
            $error = new SyncError($existingUser, $exception);

View on GitHub (pinned to 31c1bbc10f)