passbolt/passbolt_api · error · Passbolt\Scim\Exception\ConflictException

The resource could not be created due to a uniqueness…

Error message

The %s resource could not be created due to a uniqueness conflict

What it means

This ConflictException is raised by assertNoScimEntryConflict() during create() when a non-SCIM passbolt user with the same email already exists AND that user already has a linked scim_entry row. Creating a second SCIM resource for it would break the 1:1 user↔scim_entry mapping.

Solutions

GET /scim/v2/Users?filter=userName eq "..." to check existence before POSTing; use PATCH/PUT on the existing resource
Inspect the scim_entries table for stale rows tied to the user and clean them up if the sync was re-initialized
Reconcile the IdP's externalId store with passbolt's scim_entries to restore the 1:1 mapping

Defensive patterns

Strategy: try-catch

Validate before calling

$existing = $http->get('/scim/v2/Users?filter=userName eq "' . urlencode($userName) . '"');
if (!empty(json_decode($existing->getBody(), true)['Resources'])) {
    // resource exists: PATCH/PUT instead of POST
}

Try / catch

try {
    $scimUsers->create();
} catch (\Passbolt\Scim\Exception\ConflictException $e) {
    if ($e->getScimType() === 'uniqueness') {
        $user = $scimUsers->findByUserName($userName);
        $scimUsers->patch($user['id'], $patchRequest); // adopt existing resource
    }
}

Prevention

Always filter-by-userName before create in sync logic
Reconcile scim_entries with the IdP's externalId store after restores or re-provisioning
Avoid deleting SCIM users without cleaning their linked scim_entries

When it happens

Trigger: POST /scim/v2/Users with a work email matching an existing passbolt user that is already SCIM-provisioned (or a stale duplicate scim_entry row exists).

Common situations: IdP retrying a create after a partially failed earlier sync (user+entry created but response lost), users manually created then imported into SCIM, or leftover scim_entries from removed sync configurations.

Understand the failure class

Background: "already exists" / EEXIST / FileAlreadyExistsException: what the 'file already exists' error means and how to fix it — this error's family across 37 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7d3250c94c08601f. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php:340

        if ($user !== null) {
            // Load associations separately so that FOR UPDATE works with postgres/mysql both.
            $this->Users->loadInto($user, ['Profiles', 'ScimEntries']);
        }

        return $user;
    }

    /**
     * Throw if the existing user already has a SCIM entry.
     *
     * @param \App\Model\Entity\User|null $user
     * @throws \Passbolt\Scim\Exception\ConflictException
     */
    private function assertNoScimEntryConflict(?User $user): void
    {
        if (!empty($user->scim_entry)) {
            throw new ConflictException(
                sprintf(
                    'The %s resource could not be created due to a uniqueness conflict',
                    $this->getType()
                ),
                scimType: ScimException::SCIM_TYPE_UNIQUENESS,
            );
        }
    }

    /**
     * Register a brand-new user via the Users table.
     *
     * @return \App\Model\Entity\User
     * @throws \Passbolt\Scim\Exception\ConflictException
     */
    private function registerNewUser(): User
    {
        $scimUser = $this->getScimSettingsSelectedUser();

View on GitHub (pinned to 31c1bbc10f)