passbolt/passbolt_api · error · ConflictException

Validation error message from the failed entity save…

Error message

Validation error message from the failed entity save (dynamic)

What it means

In updateDatabaseUser(), when Users->save() on the user entity fails (atomic: false), the resource throws a 409 ConflictException whose message is the entity's validation error summary (via getValidationErrorMessage), with scimType `invalidValue`. The message is dynamic — inspect the actual response body to see which field failed.

Solutions

1. Read the ConflictException message — it lists the exact field(s) and validation rules that failed.
2. Fix the attribute value in the IdP source data (length, charset, format) and re-sync.
3. Run `ddev exec vendor/bin/phpunit` or inspect the Users table validation rules to confirm the constraints before crafting values.
4. Check logScimDebug output / ScimLog for the submitted $userPatchData and entity errors.

Example fix

// before
{"Operations":[{"op":"replace","path":"name.givenName","value":"  "}]}
// after (non-empty, valid UTF-8, within length limits)
{"Operations":[{"op":"replace","path":"name.givenName","value":"Alice"}]}

// pre-validate values against passbolt rules before PATCH
function validName(v) { return typeof v === 'string' && v.trim().length > 0 && v.length <= 255; }
if (!validName(op.value)) throw new Error('invalid name value for SCIM patch');

const isNonEmptyString = (v) => typeof v === 'string' && v.trim().length > 0;

try { await scim.patchUser(id, ops); } catch (e) { if (e.status === 409 && e.scimType === 'invalidValue') { log('validation failed: ' + e.message); } else throw e; }

When it happens

Trigger: PATCH/PUT /scim/v2/Users/<id> producing a userPatchData array (profile names, disabled flag) that fails Users table validation rules — e.g. invalid first_name/last_name characters or length, or a conflicting username — during the save call.

Common situations: An IdP pushes names with characters or lengths disallowed by passbolt validation; a userName change collides with an existing user or violates the username format rule; locale/encoding issues cause profile fields to fail validation.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• The User resource could not be deleted due to validation…
• Could not save the account recovery private key.
• Could not save the account recovery setting.
• Could not validate the SCIM settings.
• Could not validate the SCIM settings found in database.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7294253e5d10932a. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Scim/src/Utility/Resource/UserScimResource.php:793

                    $this->Users->patchEntity($this->userEntity, $userPatchData, [
                        'accessibleFields' => [
                            'disabled' => true,
                        ],
                        'associated' => [
                            'Profiles' => [
                                'validate' => 'register',
                                'accessibleFields' => [
                                    'first_name' => true,
                                    'last_name' => true,
                                ],
                            ],
                        ],
                    ]);
                    if (!$this->Users->save($this->userEntity, ['atomic' => false])) {
                        ScimLog::error('Unable to update the user from the request data');
                        $this->logScimDebug('updateDatabaseUser/user', $userPatchData, $this->userEntity);

                        throw new ConflictException(
                            $this->getValidationErrorMessage($this->userEntity),
                            scimType: ScimException::SCIM_TYPE_INVALID_VALUE
                        );
                    }
                }
                if ($scimEntryPatchData) {
                    $scimEntry = $this->userEntity->scim_entry ?? null;
                    if (!$scimEntry) {
                        $scimEntry = $this->Users->ScimEntries->newEmptyEntity();
                        $scimEntryPatchData['foreign_model'] = ScimEntry::FOREIGN_MODEL_USERS;
                        $scimEntryPatchData['foreign_key'] = $this->userEntity->id;
                    }
                    $this->Users->ScimEntries->patchEntity($scimEntry, $scimEntryPatchData, [
                        'accessibleFields' => [
                            'foreign_key' => true,
                            'foreign_model' => true,
                            'external_identifier' => true,
                            'scim_name' => true,

View on GitHub (pinned to 31c1bbc10f)