passbolt/passbolt_api · warning · ForbiddenException

You are not authorized to access that location.

Error message

You are not authorized to access that location.

What it means

DirectorySettingsController::view() throws this ForbiddenException (HTTP 403) when the authenticated user is not an administrator. Reading the directory sync settings via GET /directorysync/settings is admin-only. The request is authenticated and routed correctly, but the role check `$this->User->isAdmin()` failed.

Solutions

1. Authenticate the request with an administrator account's credentials/token.
2. Check the user's role and promote to admin if appropriate via the admin promotion flow.
3. Verify you are hitting the correct passbolt instance/environment where the account is an admin.
4. If automation is intended, create or use a dedicated admin service account.

Example fix

// before
# reading settings as a regular user
curl -H 'Authorization: Bearer <user-token>' https://passbolt.example.com/directorysync/settings.json
// 403
// after
# use an admin account/token
curl -H 'Authorization: Bearer <admin-token>' https://passbolt.example.com/directorysync/settings.json

// ensure the token belongs to an admin before calling
const me = await api.get('/users/me.json');
if (me.body.role.name !== 'admin') {
    throw new Error('Admin role required to read directory sync settings');
}

function isAdminUser(user) {
  return typeof user === 'object' && user !== null
    && user.role?.name === 'admin';
}

try {
    const res = await api.get('/directorysync/settings.json');
} catch (e) {
    if (e.response?.status === 403) {
        throw new Error('Current account is not an admin; use an admin token.');
    }
    throw e;
}

When it happens

Trigger: GET /directorysync/settings performed by a logged-in user whose role is not 'admin' (e.g. 'user' role).

Common situations: Service accounts or automation scripts using a non-admin user's token; users clicking into admin settings URLs; role changed after the token was issued; using a regular user's API key instead of an admin's.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Access restricted to administrators.
• You are not authorized to access that location.
• Only administrators are allowed to create/update MFA…
• Only administrators can add new users.
• Only administrators can view reports.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0c02d75409d3d1c7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/DirectorySync/src/Controller/DirectorySettingsController.php:53

     *
     * @return void
     * @throws \Exception
     */
    public function initialize(): void
    {
        parent::initialize();
        $this->loadComponent('ObfuscateFields', ['fields' => ['password']]);
    }

    /**
     * Retrieve the settings
     *
     * @return void
     */
    public function view()
    {
        if (!$this->User->isAdmin()) {
            throw new ForbiddenException(__('You are not authorized to access that location.'));
        }

        try {
            $directoryOrgSettings = DirectoryOrgSettings::get();
            $settings = $directoryOrgSettings->toArray();
        } catch (RecordNotFoundException $e) {
            $settings = [];
        }

        $formData = LdapConfigurationForm::formatOrgSettingsToFormData($settings);
        $this->success(__('The operation was successful.'), $formData);
    }

    /**
     * Update the settings
     *
     * @return void
     */

View on GitHub (pinned to 31c1bbc10f)