passbolt/passbolt_api · error · BadRequestException

Only administrators can create SSO settings.

Error message

Only administrators can create SSO settings.

What it means

SsoSettingsSetService::create() requires the acting user (via UserAccessControl) to be an administrator. If $uac->isAdmin() is false it throws BadRequestException 'Only administrators can create SSO settings.' This enforces that only admins may define SSO configuration.

Solutions

  1. Perform the operation as, or with a UserAccessControl for, a user with role 'admin'.
  2. Check the authenticated user's role; promote if legitimately intended (users table role_id).
  3. In CLI/automation code, build UAC from an admin user (e.g. new UserAccessControl('admin', $adminId)).
  4. Ensure the API client is using admin credentials, not a standard user's.

Example fix

// before
$uac = new UserAccessControl($user['role']['name'], $user['id']); // 'user'
$service->create($uac, $data);
// after
if (!$uac->isAdmin()) {
    throw new ForbiddenException(__('Only administrators can create SSO settings.'));
}
$service->create($uac, $data);
Defensive patterns

Strategy: validation

Validate before calling

if (!$uac->isAdmin()) { throw new ForbiddenException(__('Administrator role required')); }

Type guard

$isAdmin = $uac->isAdmin();

Try / catch

try { $service->create($uac, $data); } catch (BadRequestException $e) { if (str_contains($e->getMessage(), 'administrators')) { // escalate or reject } }

Prevention

When it happens

Trigger: A non-admin (logged-in user, or service/UAC built from a non-admin role) calls the create SSO settings service or the POST /sso/settings endpoint.

Common situations: Integrations calling the API with a regular user token; CLI jobs constructing UserAccessControl with role 'user'; testing with a non-admin account.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/081012f19b2b3657. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsSetService.php:49

use Passbolt\Sso\Form\SsoSettingsGoogleDataForm;
use Passbolt\Sso\Form\SsoSettingsOAuth2DataForm;
use Passbolt\Sso\Form\SsoSettingsPingOneDataForm;
use Passbolt\Sso\Model\Dto\SsoSettingsDto;
use Passbolt\Sso\Model\Entity\SsoSetting;

class SsoSettingsSetService
{
    /**
     * Create an encrypted org setting
     *
     * @param \App\Utility\UserAccessControl $uac user access control
     * @param array $data user provided data
     * @return \Passbolt\Sso\Model\Dto\SsoSettingsDto
     */
    public function create(UserAccessControl $uac, array $data): SsoSettingsDto
    {
        if (!$uac->isAdmin()) {
            throw new BadRequestException(__('Only administrators can create SSO settings.'));
        }

        $form = $this->getSsoSettingsForm($data);
        if (!$form->execute($data)) {
            throw new CustomValidationException(
                __('Something went wrong when validating the single-sign on settings.'),
                $form->getErrors()
            );
        }
        $data = $form->getData();

        // Prepare the data, serialize the JSON and encrypt using server key
        $serializedData = $this->serializeData($data['provider'], $data['data']);
        $encryptedData = $this->encrypt($serializedData);

        // Build entity
        $ssoSettingsTable = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoSettings');
        /** @var \Passbolt\Sso\Model\Entity\SsoSetting $ssoSettingEntity */

View on GitHub (pinned to 31c1bbc10f)