passbolt/passbolt_api · critical · Cake\Http\Exception\InternalErrorException

The SCIM settings could not be encrypted with the server…

Error message

The SCIM settings could not be encrypted with the server gpg key.

What it means

This InternalErrorException wraps any failure while encrypting SCIM settings before persisting them. encryptSettings() builds an OpenPGP backend, sets the server public key via setEncryptKeyWithServerKey(), and encrypts the JSON-encoded settings payload. If encryption fails, the raw GPG error is prefixed and rethrown as a 500; the settings are NOT saved.

Solutions

Re-import or regenerate the server GPG key so the configured fingerprint exists in the web server user's keyring (use passbolt's serverkey generation/import commands), then verify with passbolt healthcheck
Fix the passbolt.gpg.serverKey configuration (fingerprint, public key path) in config/passbolt.php so it points at the actual key in the keyring
Ensure GNUPGHOME for the web server user is correct and that ~/.gnupg and its files are owned by and readable/writable by that user
Clear the GnuPG keyring cache/misconfigured agent state if keys exist but encryption still fails, and retry the settings save

Example fix

// before (fingerprint not present in keyring)
'passbolt' => ['gpg' => ['serverKey' => ['fingerprint' => 'ABSENT_FP', 'public' => '/wrong/key.asc']]],

// after
'passbolt' => ['gpg' => ['serverKey' => ['fingerprint' => 'FP_OF_IMPORTED_KEY', 'public' => '/home/www-data/.gnupg/serverkey.asc']]],

Defensive patterns

Strategy: try-catch

Validate before calling

$fingerprint = Configure::read('passbolt.gpg.serverKey.fingerprint');
$info = gnupg_keyinfo($gpg, $fingerprint);
if (empty($info) || empty($info[0]['subkeys'][0]['can_encrypt'] ?? false)) {
  throw new Exception('Server key cannot encrypt: fingerprint missing from keyring');
}

Type guard

function serverKeyIsEncryptable(string $fingerprint, string $gnupgHome): bool {
  $gpg = gnupg_init();
  putenv("GNUPGHOME=$gnupgHome");
  $keys = gnupg_keyinfo($gpg, $fingerprint);
  return !empty($keys);
}

Try / catch

try {
  $service->saveSettings($uac, $data);
} catch (InternalErrorException $e) {
  $this->log('SCIM settings encryption failed: ' . $e->getMessage());
  // fix server key config, then retry save
}

Prevention

Verify the server key fingerprint exists in the web-server user's keyring after installs and migrations
Ensure GNUPGHOME ownership/permissions match the web server user
Run GPG healthchecks in deployment pipelines before enabling SCIM
Keep the public key file path in config accurate and readable

When it happens

Trigger: Calls to saveSettings, rehashToken or migrate when the server public key cannot be loaded or used: the passbolt.gpg.serverKey fingerprint does not match a key in the keyring, the public key file configured is missing/unreadable, GNUPGHOME is wrong for the web server user, or the GnuPG backend itself fails to initialize for the given payload.

Common situations: Fresh installs where the server key was never imported into the web-server user's keyring; instances migrated to a new server whose GNUPGHOME lacks the passbolt server key; wrong fingerprint configured in passbolt.php; permissions on ~/.gnupg owned by a different user (e.g. root vs www-data) after manual key generation.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0df442fd2df79d4b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Service/ScimBaseSettingsService.php:108

        return $data;
    }

    /**
     * @param array $settingsValue
     * @return string
     */
    protected function encryptSettings(array $settingsValue): string
    {
        try {
            $gpg = OpenPGPBackendFactory::get();
            $gpg = $this->setEncryptKeyWithServerKey($gpg);

            $data = $gpg->encrypt(json_encode($settingsValue));
        } catch (Exception $exception) {
            $msg = $exception->getMessage() . ' ';
            $msg .= __('The SCIM settings could not be encrypted with the server gpg key.');
            throw new InternalErrorException($msg, 500, $exception);
        }

        return $data;
    }

    /**
     * @return array<null>
     */
    protected function getDefaultSettings(): array
    {
        return [];
    }
}

View on GitHub (pinned to 31c1bbc10f)