passbolt/passbolt_api · error · ForbiddenException

Directory sync settings endpoints are disabled.

Error message

Directory sync settings endpoints are disabled.

What it means

ForbiddenException raised by DirectorySyncEndpointsSecurityMiddleware::process() when the Configure flag at self::SECURITY_CONFIG_KEY (passbolt security setting disabling directory sync endpoints) is truthy. The middleware blocks all directory sync settings endpoints at the HTTP layer before controllers run.

Solutions

1. Set the security flag to false in config (e.g. passbolt.php or environment variable) to re-enable the endpoints
2. Check which environment's config is actually loaded (app.default.php vs passbolt.php overrides)
3. Only disable the flag while configuring LDAP, and re-enable it afterwards to keep the hardening
4. If endpoints must stay locked, manage directory sync via CLI commands instead of the HTTP API

Example fix

// before: endpoints disabled
'security' => ['directorySyncEndpoints' => true]
// after: endpoints enabled
'security' => ['directorySyncEndpoints' => false]

// detect whether directory sync endpoints are disabled before calling
const enabled = await api.get('/directorysync/settings').catch(e => e.status !== 403);
if (!enabled) throw new Error('Directory sync endpoints are disabled by security config');

null

try {
    await api.get('/directorysync/settings');
} catch (e) {
    if (e.status === 403 && e.message.includes('endpoints are disabled')) {
        alertOps('Enable passbolt security.directorySyncEndpoints to use this endpoint');
    }
}

When it happens

Trigger: Any request to /directorysync/* endpoints while the security flag is enabled, e.g. passbolt.security.directorySyncEndpoints disabled in config, typically set deliberately via environment/config to harden a production instance.

Common situations: Fresh deployments with the hardening flag enabled by default; teams enabling endpoints for LDAP setup then forgetting to disable the flag again — or conversely, hitting this flag in a local dev environment; config file not loaded for the expected environment.

Related errors

• SSO settings edit endpoints are disabled.
• Metadata settings endpoints are disabled.
• Secret revisions settings endpoints are disabled.
• You are not authorized to access that location.
• group(s) returned by your directory are invalid and will be…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/b2ecddce46d980cd. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Middleware/DirectorySyncEndpointsSecurityMiddleware.php:38

use Cake\Http\Exception\ForbiddenException;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class DirectorySyncEndpointsSecurityMiddleware implements MiddlewareInterface
{
    public const SECURITY_CONFIG_KEY = 'passbolt.security.directorySync.endpointsDisabled';

    /**
     * @param \Psr\Http\Message\ServerRequestInterface $request The request.
     * @param \Psr\Http\Server\RequestHandlerInterface $handler The handler.
     * @return \Psr\Http\Message\ResponseInterface The response.
     */
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        if (Configure::read(self::SECURITY_CONFIG_KEY)) {
            throw new ForbiddenException(__('Directory sync settings endpoints are disabled.'));
        }

        return $handler->handle($request);
    }
}

View on GitHub (pinned to 31c1bbc10f)