passbolt/passbolt_api · error · BadRequestException

The SSO settings do not exist.

Error message

The SSO settings do not exist.

What it means

This BadRequestException is thrown by the generic OAuth2 SSO recover-login controller when SsoSettingsGetService::getActiveOrFail finds no active SSO settings record (RecordNotFoundException). Starting an OAuth2-based recovery login requires an active SSO configuration on the instance.

Solutions

1. Re-enable the SSO/OAuth2 configuration in the admin SSO settings.
2. Fall back to the standard passphrase-based account recovery.
3. Verify the correct environment/instance is being used where SSO is active.
4. Check the sso_settings table and recent migrations if the configuration should exist.

// Before starting recovery, check SSO availability
const settings = await ssoSettingsApi.get();
if (!settings) throw new Error('No active SSO settings; OAuth2 recovery login is unavailable.');

function hasActiveSso(settings) {
  return settings != null && typeof settings.id === 'string' && settings.status === 'active';
}

try {
  await startOauth2SsoRecoverLogin();
} catch (e) {
  if (e.message.includes('The SSO settings do not exist')) {
    fallbackToPassphraseRecovery();
  }
}

When it happens

Trigger: GET /sso/recover/login/oauth2 while SSO is disabled or deleted (no active row in sso_settings), or the provider configuration was changed to inactive after recovery emails were sent.

Common situations: Admin removed or disabled the OAuth2 SSO provider after sending recovery emails; user clicks a stale recovery link; environment mismatch (e.g. production link opened against a local instance without SSO configured).

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• Invalid provider. Expected OAuth2.
• No valid SSO settings found.
• Single sign-on failed. The
• The SSO settings do not exist.
• AccessToken should be an instance of BaseIdToken class.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/1ae464cc997ffc8f. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Controller/OAuth2/OAuth2RecoverLoginController.php:53

     */
    public function beforeFilter(EventInterface $event)
    {
        parent::beforeFilter($event);
        $this->Authentication->allowUnauthenticated(['login']);
    }

    /**
     * Return a URL to redirect the user to perform SSO (without hint)
     *
     * @param \App\Service\Cookie\AbstractSecureCookieService $cookieService Cookie service
     * @return void
     */
    public function login(AbstractSecureCookieService $cookieService): void
    {
        try {
            (new SsoSettingsGetService())->getActiveOrFail();
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);
        }

        $this->User->assertNotLoggedIn();

        $uac = new ExtendedUserAccessControl(
            Role::GUEST,
            null,
            null,
            $this->User->ip(),
            $this->User->userAgent()
        );

        $url = $this->getSsoUrlWithCookie(new SsoOAuth2Service($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);

        $this->success(__('The operation was successful.'), $url->jsonSerialize());
    }
}

View on GitHub (pinned to 31c1bbc10f)