TechnitiumSoftware/DnsServer · warning · InvalidOperationException

Time-based one-time password (TOTP) feature is not available

Error message

Time-based one-time password (TOTP) feature is not available for SSO users.

What it means

Thrown by User.InitializedTOTP(issuer) when the target user is an SSO user. Two-factor TOTP is a local-credential feature that supplements a local password; because SSO users authenticate externally, the local TOTP secret would never be consulted and enabling it would mislead administrators. The check runs before AuthenticatorKeyUri.Generate so no key material is created.

Source

Thrown at DnsServerCore/Auth/User.cs:284

            _salt = new byte[32];
            RandomNumberGenerator.Fill(_salt);

            _passwordHash = GetPasswordHashFor(newPassword);
        }

        public void LoadOldSchemeCredentials(string passwordHash)
        {
            if (_isSsoUser)
                throw new InvalidOperationException();

            _passwordHashType = UserPasswordHashType.OldScheme;
            _passwordHash = passwordHash;
        }

        public AuthenticatorKeyUri InitializedTOTP(string issuer)
        {
            if (_isSsoUser)
                throw new InvalidOperationException("Time-based one-time password (TOTP) feature is not available for SSO users.");

            if (_totpEnabled)
                throw new InvalidOperationException("Time-based one-time password (TOTP) is already enabled for user: " + _username);

            _totpKeyUri = AuthenticatorKeyUri.Generate(issuer, _username);

            return _totpKeyUri;
        }

        public void EnableTOTP(string totp)
        {
            if (_isSsoUser)
                throw new InvalidOperationException("Time-based one-time password (TOTP) feature is not available for SSO users.");

            if (_totpKeyUri is null)
                throw new InvalidOperationException("Time-based one-time password (TOTP) was not initialized for user: " + _username);

            if (_totpEnabled)

View on GitHub (pinned to d0484b6c1e)

Solutions

1. Skip TOTP provisioning for SSO users by checking user.IsSsoUser first.
2. Configure MFA at the SSO identity provider level instead of relying on Technitium's local TOTP for SSO accounts.
3. Hide or disable the TOTP setup control in the UI when user.IsSsoUser is true.

Example fix

// before
var keyUri = user.InitializedTOTP(issuer);

// after
if (user.IsSsoUser)
    throw new InvalidOperationException("TOTP must be configured at the SSO provider for SSO users.");
var keyUri = user.InitializedTOTP(issuer);

if (user.IsSsoUser)
    return BadRequest("TOTP is not available for SSO users.");
var keyUri = user.InitializedTOTP(issuer);

static bool SupportsLocalTotp(User user) => !user.IsSsoUser;

When it happens

Trigger: Calling user.InitializedTOTP(issuer) on any User with _isSsoUser == true, typically through the 'enable two-factor authentication' web API action for an SSO-linked account.

Common situations: Enforcing a blanket 'all users must have TOTP' policy that ignores account type; an admin dashboard that shows the TOTP setup button uniformly; importing SSO users and running a provisioning script that calls InitializedTOTP for everyone.

Related errors

• Time-based one-time password (TOTP) is already enabled for u
• Time-based one-time password (TOTP) was not initialized for
• Invalid time-based one-time password (TOTP) was attempted fo
• Time-based one-time password (TOTP) is already disabled for
• Cannot change password for SSO users.

AI-assisted analysis of TechnitiumSoftware/DnsServer@d0484b6c1e (2026-08-13). Data as JSON: /api/errors/08dc1c4dc2a40eb7. Report an issue: GitHub.