passbolt/passbolt_api · error · BadRequestException

The SSO setting id should be a uuid.

Error message

The SSO setting id should be a uuid.

What it means

assertAndGetSettings() validates the SSO settings id with Cake Validation::uuid() before querying. A non-UUID string is rejected immediately with a BadRequestException, avoiding a malformed database lookup.

Solutions

1. Pass the settings entity UUID exactly as returned by the SSO settings creation endpoint
2. Validate the id client-side with a UUID regex before calling activate()
3. If only a token is available, fetch the settings id from the draft settings record first

Example fix

// before
$service->activate($uac, '123', $data);
// after
if (!Validation::uuid($settingId)) { throw new \InvalidArgumentException('Need a UUID'); }
$service->activate($uac, $settingId, $data);

if (!Validation::uuid($id)) { throw new BadRequestException(__('The SSO setting id should be a uuid.')); }

function isUuid(?string $id): bool { return is_string($id) && (bool)preg_match('/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i', $id); }

try { $service->activate($uac, $id, $data); } catch (BadRequestException $e) { // reject malformed id in the controller layer }

When it happens

Trigger: Calling activate() with $id set to an empty string, a numeric database key, a slug, or any malformed identifier that is not a valid UUID v4 string.

Common situations: Client code confusing the draft settings id with the auth token; truncated or URL-encoded ids; using legacy integer ids from a pre-UUID schema; copy/paste dropping characters.

Understand the failure class

Background: "invalid id" errors: invalid identifier format — why libraries reject IDs before lookup, and how to fix them — this error's family across 37 libraries.

Related errors

• The SSO setting id should be a uuid.
• Invalid status.
• The identifier should be a valid UUID.
• The identifier should be a valid UUID.
• The user id should be a valid UUID.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/00b90e6cfc5166b6. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Service/SsoSettings/SsoSettingsActivateService.php:122

            ['uac' => $uac, 'ssoSetting' => $ssoSettingEntity]
        );
        $this->SsoSettings->getEventManager()->dispatch($event);

        // Return new updated setting
        return (new SsoSettingsGetService())->getActiveOrFail(true);
    }

    /**
     * @param string $id uuid
     * @param string $status for example SsoSetting::STATUS_ACTIVE
     * @throws \Cake\Http\Exception\BadRequestException if the settings id is not a uuid
     * @throws \Cake\Http\Exception\NotFoundException if the settings id is not found
     * @return \Passbolt\Sso\Model\Entity\SsoSetting
     */
    protected function assertAndGetSettings(string $id, string $status): SsoSetting
    {
        if (!Validation::uuid($id)) {
            throw new BadRequestException(__('The SSO setting id should be a uuid.'));
        }

        try {
                $this->SsoSettings = TableRegistry::getTableLocator()->get('Passbolt/Sso.SsoSettings');
            /** @var \Passbolt\Sso\Model\Entity\SsoSetting $ssoSettings */
            $ssoSettings = $this->SsoSettings->find()->where(['id' => $id])->firstOrFail();
        } catch (RecordNotFoundException $exception) {
            throw new NotFoundException(__('The SSO setting does not exist.'), 404, $exception);
        }

        if ($ssoSettings->status !== $status) {
            throw new BadRequestException(__('The settings status is invalid.'));
        }

        return $ssoSettings;
    }

    /**

View on GitHub (pinned to 31c1bbc10f)