passbolt/passbolt_api · critical · Passbolt\Scim\Exception\ConflictException

Missing or invalid SCIM user in configuration settings

Error message

Missing or invalid SCIM user in configuration settings

What it means

This ConflictException is thrown by registerNewUser() when the SCIM settings do not reference a valid acting user. Creating a passbolt user requires a UserAccessControl built from the configured scim_user_id; if the setting is missing or the referenced user no longer exists, registration is aborted.

Solutions

1. Re-save SCIM settings (PUT /scim/v2/settings) ensuring a valid scim_user_id is set, or run the SCIM setup command
2. Verify the user id in scim_settings exists in the users table and has a role (loadInto includes Roles)
3. Check logs for ScimGetSettingsService failures indicating decryption/settings issues

$settings = (new \Passbolt\Scim\Service\ScimGetSettingsService())->getSettingsDecryptedValue();
if (empty($settings['scim_user_id'])) {
    throw new RuntimeException('SCIM is not fully configured: scim_user_id missing.');
}
$user = TableRegistry::getTableLocator()->get('Users')
    ->find()->contain(['Roles'])->where(['id' => $settings['scim_user_id']])->first();
if (!$user) {
    throw new RuntimeException('Configured SCIM user does not exist.');
}

try {
    $scimUsers->create();
} catch (\Passbolt\Scim\Exception\ConflictException $e) {
    if ($e->getMessage() === 'Missing or invalid SCIM user in configuration settings') {
        // re-run SCIM setup: re-save settings with a valid scim_user_id
    }
}

When it happens

Trigger: POST /scim/v2/Users for a brand-new user while passbolt SCIM settings have an empty/missing scim_user_id, or the configured scim_user_id points to a deleted or non-existent user.

Common situations: SCIM enabled but the setup step that picks the acting SCIM admin user was skipped; the designated SCIM user was deleted or deactivated; database restored without the settings row; settings encrypted payload lost scim_user_id.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• SCIM settings endpoints are disabled.
• The SCIM secret token expiry configuration is invalid.
• 500
• A mapping rule for ID attribute could not be found for…
• A mapping rule for username attribute could not be found…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/b1df87331548d0e5. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php:360

                    'The %s resource could not be created due to a uniqueness conflict',
                    $this->getType()
                ),
                scimType: ScimException::SCIM_TYPE_UNIQUENESS,
            );
        }
    }

    /**
     * Register a brand-new user via the Users table.
     *
     * @return \App\Model\Entity\User
     * @throws \Passbolt\Scim\Exception\ConflictException
     */
    private function registerNewUser(): User
    {
        $scimUser = $this->getScimSettingsSelectedUser();
        if (!$scimUser) {
            throw new ConflictException(__('Missing or invalid SCIM user in configuration settings'));
        }

        $uac = new UserAccessControl($scimUser->role->name, $scimUser->id);

        try {
            return $this->Users->register([
                'username' => $this->email,
                'disabled' => $this->getDisabledValue($this->active),
                'profile' => [
                    'first_name' => $this->firstName,
                    'last_name' => $this->lastName,
                ],
            ], $uac);
        } catch (ValidationException $exception) {
            throw new ConflictException(
                $this->getValidationErrorMessage($exception->getEntity()),
                scimType: ScimException::SCIM_TYPE_INVALID_VALUE
            );

View on GitHub (pinned to 31c1bbc10f)