passbolt/passbolt_api · error · ForbiddenException

Only administrators are allowed to create/update MFA…

Error message

Only administrators are allowed to create/update MFA policies settings.

What it means

The MfaPolicies settings POST endpoint is admin-only. MfaPoliciesSettingsSetController::post() checks $this->User->isAdmin() and throws ForbiddenException when the authenticated user lacks administrator privileges.

Solutions

Authenticate as a passbolt administrator account before calling the endpoint
Grant administrator role to the intended service account if it legitimately must manage MFA policies
Verify the request actually carries valid authentication headers (X-CSRF-Token, session) and isn't degrading to a less-privileged identity

Defensive patterns

Strategy: type-guard

Validate before calling

if (!\App\Utility\User::get()->role->is('admin')) {
    // skip call to POST /mfa/policies/settings.json
}

Type guard

$isAdmin = ($user['role']['name'] ?? null) === Role::ADMIN;

Try / catch

try {
    $resp = $client->post('/mfa/policies/settings.json', $data);
} catch (HttpException $e) {
    if ($e->getCode() === 403) { /* not admin */ }
}

Prevention

Use an admin service account for settings automation
Check role before invoking admin-only endpoints
Never reuse non-admin tokens for configuration tasks

When it happens

Trigger: A non-admin authenticated user (or anonymous user reaching the endpoint before auth) issues POST to /mfa/policies/settings.json.

Common situations: Automated scripts or CI using a regular user's API token to push MFA policy settings; testing the endpoint with a non-admin account.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/c6f25c9930e4ebcd. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/MfaPolicies/src/Controller/MfaPoliciesSettingsSetController.php:37

use App\Controller\AppController;
use App\Error\Exception\FormValidationException;
use Cake\Http\Exception\ForbiddenException;
use Passbolt\MfaPolicies\Form\MfaPoliciesSettingsForm;
use Passbolt\MfaPolicies\Model\Dto\MfaPolicySettings;
use Passbolt\MfaPolicies\Service\MfaPoliciesSetSettingsService;

class MfaPoliciesSettingsSetController extends AppController
{
    /**
     * Create/update MFA policies settings.
     *
     * @return void
     */
    public function post()
    {
        if (!$this->User->isAdmin()) {
            throw new ForbiddenException(
                __('Only administrators are allowed to create/update MFA policies settings.')
            );
        }

        $requestData = $this->getRequest()->getData();

        $form = new MfaPoliciesSettingsForm();

        if (!$form->execute($requestData)) {
            throw new FormValidationException(__('Could not validate the MFA policies settings.'), $form);
        }

        $setSettingsService = new MfaPoliciesSetSettingsService();

        $mfaPolicySettingsDto = MfaPolicySettings::createFromArray([
            'policy' => $form->getData('policy'),
            'remember_me_for_a_month' => $form->getData('remember_me_for_a_month'),
        ]);

View on GitHub (pinned to 31c1bbc10f)