passbolt/passbolt_api · error · BadRequestException

The SSO settings do not exist.

Error message

The SSO settings do not exist.

What it means

Thrown by PingOneRecoverLoginController::login when SsoSettingsGetService::getActiveOrFail() raises RecordNotFoundException, meaning no active SSO settings row exists in the database. Passbolt requires configured, active SSO settings before serving any PingOne SSO recovery login endpoint.

Solutions

1. Configure SSO settings as admin (Admin workspace > SSO or POST /sso/settings) and activate them
2. Verify the sso_settings table contains a row with status set to active via DB query or GET /sso/settings
3. Confirm you are on the correct instance/environment where SSO was configured
4. If SSO is not intended, use the standard non-SSO recover/login endpoints

Example fix

// before: endpoint called with no settings
GET /sso/recover/pingone/login  -> 400 The SSO settings do not exist.
// after: configure first
POST /sso/settings (provider: pingone, ...) -> activate -> GET /sso/recover/pingone/login

const settings = await fetch('/sso/settings.json', {headers: authHeaders});
if (!settings.ok || !(await settings.json()).body?.some(s => s.status === 'active')) {
  throw new Error('No active SSO settings; configure SSO before PingOne login.');
}

try {
  await pingOneRecoverLogin();
} catch (e) {
  if (e.message === 'The SSO settings do not exist.') {
    redirectToStandardRecover();
  } else throw e;
}

When it happens

Trigger: GET request to the PingOne SSO recover login endpoint while the sso_settings table has no row in an active state (or none at all); SSO settings were deleted or disabled.

Common situations: SSO plugin enabled in code but settings never saved via admin UI/API; environment restored from a backup without sso_settings; settings deactivated during a provider migration (e.g. switching away from PingOne).

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• No valid SSO settings found.
• Invalid provider. Expected PingOne.
• No valid SSO settings found.
• No valid SSO settings found.
• No valid SSO settings found.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/71a1ab00b2eb728d. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Controller/PingOne/PingOneRecoverLoginController.php:53

     */
    public function beforeFilter(EventInterface $event)
    {
        parent::beforeFilter($event);
        $this->Authentication->allowUnauthenticated(['login']);
    }

    /**
     * Return a URL to redirect the user to perform SSO (without hint)
     *
     * @param \App\Service\Cookie\AbstractSecureCookieService $cookieService Cookie service
     * @return void
     */
    public function login(AbstractSecureCookieService $cookieService): void
    {
        try {
            (new SsoSettingsGetService())->getActiveOrFail();
        } catch (RecordNotFoundException $e) {
            throw new BadRequestException(__('The SSO settings do not exist.'), null, $e);
        }

        $this->User->assertNotLoggedIn();

        $uac = new ExtendedUserAccessControl(
            Role::GUEST,
            null,
            null,
            $this->User->ip(),
            $this->User->userAgent()
        );

        $url = $this->getSsoUrlWithCookie(new SsoPingOneService($cookieService), $uac, SsoState::TYPE_SSO_RECOVER);

        $this->success(__('The operation was successful.'), $url->jsonSerialize());
    }
}

View on GitHub (pinned to 31c1bbc10f)