passbolt/passbolt_api · error · BadRequestException

The user does not exist or has been deleted.

Error message

The user does not exist or has been deleted.

What it means

During SSO recovery, isAllowedForSelfRegister checks that the SelfRegistration feature plugin is enabled before allowing a non-existent user to self-register via the SSO provider. If the plugin is disabled, passbolt cannot verify the email domain is allowed and reports the user as nonexistent/deleted.

Solutions

1. Enable the SelfRegistration plugin: set passbolt plugins SelfRegistration enabled true in config (and have a valid EE subscription)
2. Alternatively, create the user account first (admin sends an invitation) so SSO recover proceeds for an existing user
3. Check config/passbolt.php or self-registration settings in the admin UI to confirm an allowed domain is configured
4. Verify the subscription key is valid so EE plugins load

Example fix

// config/passbolt.php
'plugins' => [
    'SelfRegistration' => ['enabled' => true],
]

// admin-side pre-check
const settings = await fetch('/selfregistration/settings.jsonapi').then(r => r.json());
const enabled = settings.data?.providers?.emailDomain?.enabled ?? false;
if (!enabled) console.warn('SelfRegistration disabled: unknown SSO users cannot self-register');

try {
  const res = await fetch('/sso/recover/...');
  if (!res.ok) {
    const body = await res.json();
    if (body.message === 'The user does not exist or has been deleted.') {
      showInviteRequiredScreen();
    }
  }
} catch (e) { /* network error */ }

When it happens

Trigger: A user not yet in the database completes SSO authentication while the SelfRegistration (EE) plugin is disabled; assertAndGetRedirectUrl -> isAllowedForSelfRegister runs with the feature flag off.

Common situations: Fresh EE install where self-registration was never enabled; admin disabled the SelfRegistration plugin but users still try to sign up through SSO; license expired so EE plugins fail to load.

Related errors

• Access to this service requires an invitation. Please…
• Ajax/Json request not supported.
• Recovery request cannot be created when organization policy…
• The self registration plugin is not enabled.
• AccessToken should be an instance of BaseIdToken class.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/373d8432e2ecba36. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/SsoRecover/src/Service/SsoRecoverAssertService.php:118

            $uac,
            SsoState::TYPE_SSO_RECOVER,
            $ssoService->getSettings()->id
        );

        return Router::url("/sso/recover/{$provider}/success?token={$ssoAuthToken->token}", true);
    }

    /**
     * @param \Passbolt\Sso\Utility\OpenId\SsoResourceOwnerInterface $resourceOwner Resource owner.
     * @return void
     * @throws \Cake\Http\Exception\BadRequestException When self-registration plugin is disabled.
     * @throws \Cake\Http\Exception\BadRequestException When email domain is not allowed.
     * @throws \Cake\Http\Exception\BadRequestException When email domains doesn't exist.
     */
    private function isAllowedForSelfRegister(SsoResourceOwnerInterface $resourceOwner): void
    {
        if (!$this->isFeaturePluginEnabled('SelfRegistration')) {
            throw new BadRequestException(__('The user does not exist or has been deleted.'));
        }

        $selfRegistrationService = new SelfRegistrationEmailDomainsDryRunService();
        $data = ['email' => $resourceOwner->getEmail()];

        try {
            $selfRegistrationService->canGuestSelfRegister($data);
        } catch (CustomValidationException | ForbiddenException $e) {
            $msg = __('Access to this service requires an invitation. ');
            $msg .= __('Please contact your administrator to request an invitation link.');

            throw new BadRequestException($msg, null, $e);
        }
    }
}

View on GitHub (pinned to 31c1bbc10f)