passbolt/passbolt_api · error · RecordNotFoundException

The SSO key does not exist.

Error message

The SSO key does not exist.

What it means

After the SSO token is validated and consumed, get() loads the SsoKey scoped to both key id and the current user id; if firstOrFail() finds nothing it throws RecordNotFoundException('The SSO key does not exist.') with HTTP 404. Note this service throws RecordNotFoundException (not NotFoundException), so the caller/controller is responsible for translating it into a 404 response.

Solutions

1. Verify the key id belongs to the authenticated user and still exists in sso_keys
2. Restart the SSO key exchange flow to create a fresh key
3. Handle the RecordNotFoundException in the controller to return a proper 404 to the client
4. Confirm client and server point at the same passbolt instance/database

Example fix

// before: unhandled RecordNotFoundException bubbles as 500
$key = $this->SsoKeysGetService->get($uac, $tokenId, $keyId);
// after: caller maps to 404
try {
    $key = $this->SsoKeysGetService->get($uac, $tokenId, $keyId);
} catch (RecordNotFoundException $e) {
    throw new NotFoundException($e->getMessage());
}

// pre-check key existence and ownership
$key = $SsoKeys->find()->where(['id' => $keyId, 'user_id' => $uac->getId()])->first();
if (!$key) {
    restartSsoKeyExchange();
}

try {
    $key = $ssoKeysGetService->get($uac, $token, $keyId);
} catch (RecordNotFoundException $e) {
    throw new NotFoundException($e->getMessage()); // map to HTTP 404
}

When it happens

Trigger: Requesting an SSO key with an id that does not exist, was deleted, or belongs to a different user (lookup is filtered by user_id = uac->getId()).

Common situations: Key deleted between token exchange and key fetch; wrong user session completing the flow; id taken from a different environment/instance; race with an admin rotating SSO settings that purged keys.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• The SSO key does not exist.
• The SSO setting does not exist.
• The SSO settings do not exist.
• Record not found in table "sso_auth_tokens"
• The authentication token does not exist.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/4e35698d33c6b788. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoKeys/SsoKeysGetService.php:58

        try {
            $ssoSettingEntity = (new SsoSettingsGetService())->getActiveOrFail();
            // Token must be provided and matching the settings, user id, ip, user agent, etc.
            $ssoAuthTokenGetService = new SsoAuthenticationTokenGetService();
            $ssoAuthToken = $ssoAuthTokenGetService->getOrFail(
                $token,
                SsoState::TYPE_SSO_GET_KEY
            );
            $ssoAuthTokenGetService->assertAndConsume($ssoAuthToken, $uac, $ssoSettingEntity->id);
        } catch (RecordNotFoundException $exception) {
            throw new BadRequestException($exception->getMessage(), 400, $exception);
        }

        try {
            $SsoKeys = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoKeys');
            /** @var \Passbolt\Sso\Model\Entity\SsoKey $key entity */
            $key = $SsoKeys->find()->where(['id' => $keyId, 'user_id' => $uac->getId()])->firstOrFail();
        } catch (RecordNotFoundException $exception) {
            throw new RecordNotFoundException(__('The SSO key does not exist.'), 404, $exception);
        }

        return $key;
    }
}

View on GitHub (pinned to 31c1bbc10f)