passbolt/passbolt_api · error · BadRequestException

The SSO settings do not exist.

Error message

The SSO settings do not exist.

What it means

Exactly like the ADFS variant (error 875) but for Azure AD: the Azure recover-login controller requires an active SSO configuration and throws BadRequestException when SsoSettingsGetService::getActiveOrFail() cannot find one.

Solutions

1. Re-activate the Azure AD SSO settings (admin UI or ./bin/cake passbolt sso_settings) if Azure SSO is intended
2. Fall back to the standard email-based recover flow when SSO is intentionally disabled
3. Confirm the active provider matches the URL used (azure vs adfs vs google)
4. Inspect the sso_settings table for an active row and its provider value

try {
    $settings = (new \Passbolt\Sso\Service\SsoSettingsGetService())->getActiveOrFail();
    if ($settings->provider !== 'azure') {
        // use the URL matching the active provider instead
    }
} catch (\Cake\Datasource\Exception\RecordNotFoundException $e) {
    // SSO inactive: fall back to standard recover
}

try {
    return $this->redirect($azureRecoverLoginUrl);
} catch (\Cake\Http\Exception\BadRequestException $e) {
    if ($e->getMessage() === 'The SSO settings do not exist.') {
        return $this->redirect('/recover');
    }
    throw $e;
}

When it happens

Trigger: Hitting the Azure recover login URL (/sso/recover/login/azure) while there is no active SSO settings record, or the active record's provider is not Azure AD.

Common situations: Recovery emails sent while Azure SSO was active, then clicked after an admin disabled/deleted the settings; organization switched providers (e.g. to Google/ADFS) so the Azure-specific URL no longer resolves; unconfigured test environments.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• No valid SSO settings found.
• The SSO settings do not exist.
• Ajax/Json request not supported.
• Failed to public key properties from certificate
• Failed to read certificate

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/08bca3474851e213. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Controller/Azure/AzureRecoverLoginController.php:54

    public function beforeFilter(EventInterface $event)
    {
        parent::beforeFilter($event);

        $this->Authentication->allowUnauthenticated(['login']);
    }

    /**
     * Return a URL to redirect the user to perform SSO (without hint)
     *
     * @param \App\Service\Cookie\AbstractSecureCookieService $cookieService Cookie service
     * @return void
     */
    public function login(AbstractSecureCookieService $cookieService): void
    {
        try {
            (new SsoSettingsGetService())->getActiveOrFail();
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);
        }

        $this->User->assertNotLoggedIn();

        $uac = new ExtendedUserAccessControl(
            Role::GUEST,
            null,
            null,
            $this->User->ip(),
            $this->User->userAgent()
        );

        $url = $this->getSsoUrlWithCookie(new SsoAzureService($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);

        $this->success(__('The operation was successful.'), $url->jsonSerialize());
    }
}

View on GitHub (pinned to 31c1bbc10f)