passbolt/passbolt_api · warning · ServiceUnavailableException

Directory sync plugin is not enabled.

Error message

Directory sync plugin is not enabled.

What it means

DirectoryIgnoreController throws this ServiceUnavailableException (HTTP 503) from assertDirectoryEnabled() when the LDAP/directory sync organization settings are not enabled. All directory-ignore endpoints (toggle, view, add, delete) call it before doing any work, so none of those APIs function while the feature is disabled in org settings. It signals the feature is switched off, not that the request is malformed.

Solutions

1. Save valid LDAP settings via POST /directorysync/settings or the admin UI to enable directory sync.
2. If the feature was intentionally disabled, stop calling the /directory/import endpoints.
3. Verify org settings persistence: check the organization settings storage for the directory-sync entries.
4. Confirm the EE license/subscription is active so directory sync can be enabled.
5. Check which environment/config is loaded (passbolt.php, env vars) to ensure the right org settings source is being read.

Example fix

// before
curl -X DELETE https://passbolt.example.com/directory/import/users/<uuid>
// 503 Directory sync plugin is not enabled
// after
# first enable directory sync by saving settings
curl -X POST -H 'Content-Type: application/json' -d '{"directory_type":"ldap", ...}' \
  https://passbolt.example.com/directorysync/settings.json
# then retry the ignore endpoint

// client-side pre-check before calling ignore endpoints
const settings = await api.get('/directorysync/settings.json');
if (!settings.body || settings.status === 503) {
    throw new Error('Directory sync is not enabled; skipping ignore operations');
}

try {
    await api.delete(`/directory/import/${model}/${id}`);
} catch (e) {
    if (e.response?.status === 503) {
        console.warn('Directory sync disabled; enable it in admin settings first.');
        return; // degrade gracefully instead of failing the workflow
    }
    throw e;
}

When it happens

Trigger: Any call to GET/POST/DELETE /directory/import/... endpoints when DirectoryOrgSettings::isEnabled() returns false — i.e. no passbolt LDAP org settings saved, or the integration was disabled via the settings disable endpoint.

Common situations: Fresh passbolt EE install where LDAP settings were never saved; admin disabled directory sync but scripts still poll the ignore endpoints; wrong environment (prod settings not loaded, e.g. missing/misconfigured passbolt.php or org-settings storage) making isEnabled() false; setup without an active EE license so settings cannot be enabled.

Related errors

• 500
• A mapping rule for ID attribute could not be found for…
• A mapping rule for username attribute could not be found…
• Account recovery is disabled.
• An error has occurred parsing groupCustomFilter

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/e6ae9eca71492914. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Controller/DirectoryIgnoreController.php:198

    private function normalizeForeignModel(string $foreignModel): string
    {
        $foreignModel = ucfirst($foreignModel);
        if ($foreignModel === 'Directoryentries') {
            $foreignModel = 'DirectoryEntries';
        }

        return $foreignModel;
    }

    /**
     * Assert the directory is configured.
     *
     * @return void
     */
    protected function assertDirectoryEnabled()
    {
        if (!$this->directoryOrgSettings->isEnabled()) {
            throw new ServiceUnavailableException('Directory sync plugin is not enabled.');
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)