passbolt/passbolt_api · error · BadRequestException

No valid SSO settings found.

Error message

No valid SSO settings found.

What it means

Thrown by RecoverStartController::start when getActiveOrFail() finds no active SSO settings, wrapped from RecordNotFoundException. The SSO recover-start flow cannot proceed without configured and active SSO settings on the instance.

Solutions

1. Configure and activate SSO settings as administrator before using SSO recover
2. Verify active settings via GET /sso/settings (as admin)
3. Check the sso_settings table status column for an active record
4. Use the standard (non-SSO) /recover endpoint when SSO is not configured

Example fix

// before
POST /sso/recover/start  -> 400 No valid SSO settings found.
// after
POST /sso/settings {...} -> activate -> POST /sso/recover/start

const cfg = await fetch('/sso/settings.json').then(r => r.json());
if (!cfg.body?.providers?.length) useStandardRecover();

try {
  await ssoRecoverStart(username);
} catch (e) {
  if (e.message.includes('No valid SSO settings')) redirectToStandardRecover();
  else throw e;
}

When it happens

Trigger: POST /sso/recover/start while sso_settings has no active row; settings only in draft/inactive state; wrong environment queried.

Common situations: Fresh instance with SSO plugin enabled but unconfigured; settings deactivated by an admin; staging DB missing production SSO config; org switched providers and old rows deactivated before new ones saved.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• No valid SSO settings found.
• No valid SSO settings found.
• No valid SSO settings found.
• No valid SSO settings found.
• No valid SSO settings found.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/62fb47947c8238b2. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Controller/RecoverStartController.php:62

    /**
     * Exchange authentication token for recover URL.
     *
     * @return void
     */
    public function start(): void
    {
        if (!$this->request->is('json')) {
            throw new BadRequestException(__('This is not a valid Ajax/Json request.'));
        }

        $this->User->assertNotLoggedIn();

        // Make sure SSO settings are set.
        try {
            $settingsDto = (new SsoSettingsGetService())->getActiveOrFail();
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException(__('No valid SSO settings found.'), null, $e);
        }

        $form = new SsoRecoverStartForm();
        if (!$form->execute($this->getRequest()->getData())) {
            throw new FormValidationException(__('Could not validate the SSO recover request.'), $form);
        }

        // Assert & consume sso auth token
        $ssoAuthService = new SsoAuthenticationTokenGetService();
        try {
            $ssoAuthToken = $ssoAuthService->getOrFail(
                $form->getData('token'),
                SsoState::TYPE_SSO_RECOVER
            );
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException($e->getMessage(), null, $e);
        }

View on GitHub (pinned to 31c1bbc10f)