passbolt/passbolt_api · error · BadRequestException

The SSO settings do not exist.

Error message

The SSO settings do not exist.

What it means

This BadRequestException is thrown by the Google SSO recover-login controller when SsoSettingsGetService::getActiveOrFail raises RecordNotFoundException, meaning there is no active SSO settings row in the database. The recover login flow requires SSO to be configured and active before it can start an OAuth login.

Solutions

1. Re-enable or reconfigure SSO in the administration workspace (SSO settings must be active).
2. Have the user recover using the traditional passphrase flow instead of SSO.
3. Confirm you are hitting the environment where SSO is actually configured.
4. Inspect the sso_settings table for an active record and check migration status if settings were expected to exist.

// Admin pre-check: confirm an active SSO configuration exists before sending recover emails
const settings = await ssoSettingsApi.get();
if (!settings || settings.provider === null) throw new Error('SSO is not active; recovery emails will fail.');

function ssoIsActive(settings) {
  return settings != null && typeof settings.id === 'string' && settings.status === 'active';
}

try {
  await startGoogleSsoRecoverLogin();
} catch (e) {
  if (e.message.includes('The SSO settings do not exist')) {
    fallbackToPassphraseRecovery();
  }
}

When it happens

Trigger: GET /sso/recover/login/google while no SSO provider is enabled (sso_settings table has no active record), or the settings were disabled/deleted after the user received the recover email.

Common situations: Administrator disabled or deleted the SSO configuration after recovery emails were sent; user clicks an old Google SSO recovery link after SSO was turned off; database restored/migrated without the sso_settings rows; wrong environment (staging DB without SSO configured).

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• Invalid provider. Expected Google as provider.
• No valid SSO settings found.
• The SSO settings do not exist.
• $data['error'] (dynamic provider error)
• Invalid provider data. Expected AD FS settings.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/4b54ac70f795a5dd. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Controller/Google/GoogleRecoverLoginController.php:54

    public function beforeFilter(EventInterface $event)
    {
        parent::beforeFilter($event);

        $this->Authentication->allowUnauthenticated(['login']);
    }

    /**
     * Return a URL to redirect the user to perform SSO (without hint)
     *
     * @param \App\Service\Cookie\AbstractSecureCookieService $cookieService Cookie service
     * @return void
     */
    public function login(AbstractSecureCookieService $cookieService): void
    {
        try {
            (new SsoSettingsGetService())->getActiveOrFail();
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);
        }

        $this->User->assertNotLoggedIn();

        $uac = new ExtendedUserAccessControl(
            Role::GUEST,
            null,
            null,
            $this->User->ip(),
            $this->User->userAgent()
        );

        $url = $this->getSsoUrlWithCookie(new SsoGoogleService($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);

        $this->success(__('The operation was successful.'), $url->jsonSerialize());
    }
}

View on GitHub (pinned to 31c1bbc10f)