passbolt/passbolt_api · error · BadRequestException

The SSO settings do not exist.

Error message

The SSO settings do not exist.

What it means

The ADFS recover-login endpoint requires an active SSO configuration to build the SSO transaction. SsoSettingsGetService::getActiveOrFail() throws RecordNotFoundException when no active SSO settings row exists, which the controller converts into a BadRequestException telling the user the SSO settings do not exist.

Solutions

1. Reconfigure and activate SSO settings (via admin UI or ./bin/cake passbolt sso_settings) before using the ADFS recover flow
2. Ask users to use the standard (non-SSO) recover flow if SSO is intentionally disabled
3. Verify which SSO provider is active — the ADFS URL only works when the ADFS provider is the active setting
4. Check the sso_settings table for an active record and correct provider type

Example fix

// before: relying on stale emailed link after SSO removal
GET /sso/recover/login/adfs?...  -> 400 The SSO settings do not exist.
// after: reactivate settings or route the user to standard recover
(new SsoSettingsSetService())->createOrUpdate($adminUac, $adfsSettingsDto);
GET /sso/recover/login/adfs?...  -> 302 to ADFS

try {
    $settings = (new \Passbolt\Sso\Service\SsoSettingsGetService())->getActiveOrFail();
    $isAdfs = $settings->provider === \Passbolt\Sso\Model\Entity\SsoSettings::PROVIDER_ADFS;
} catch (\Cake\Datasource\Exception\RecordNotFoundException $e) {
    // SSO inactive: redirect to standard recover instead of the SSO URL
}

try {
    return $this->redirect($adfsRecoverLoginUrl);
} catch (\Cake\Http\Exception\BadRequestException $e) {
    if ($e->getMessage() === 'The SSO settings do not exist.') {
        return $this->redirect('/recover');
    }
    throw $e;
}

When it happens

Trigger: A user hits the ADFS recover login URL (/sso/recover/login/adfs or equivalent) while SSO has been deactivated, deleted, or was never configured for the organization.

Common situations: SSO was disabled/removed after recovery emails with SSO links were already sent; stale emailed links used after settings deletion; users bookmarking recover URLs; testing ADFS flow before saving settings.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• No valid SSO settings found.
• The SSO settings do not exist.
• Ajax/Json request not supported.
• error
• Invalid provider data. Expected AD FS settings.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/172d21418575d89b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Controller/Adfs/AdfsRecoverLoginController.php:53

     */
    public function beforeFilter(EventInterface $event)
    {
        parent::beforeFilter($event);
        $this->Authentication->allowUnauthenticated(['login']);
    }

    /**
     * Return a URL to redirect the user to perform SSO (without hint)
     *
     * @param \App\Service\Cookie\AbstractSecureCookieService $cookieService Cookie service
     * @return void
     */
    public function login(AbstractSecureCookieService $cookieService): void
    {
        try {
            (new SsoSettingsGetService())->getActiveOrFail();
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);
        }

        $this->User->assertNotLoggedIn();

        $uac = new ExtendedUserAccessControl(
            Role::GUEST,
            null,
            null,
            $this->User->ip(),
            $this->User->userAgent()
        );

        $url = $this->getSsoUrlWithCookie(new SsoAdfsService($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);

        $this->success(__('The operation was successful.'), $url->jsonSerialize());
    }
}

View on GitHub (pinned to 31c1bbc10f)