apereo/cas · warning

Email registration is not enabled for

Error message

Email registration is not enabled for [{}]

What it means

CasSimpleMultifactorSendTokenAction.routeToEmailRegistrationFlow() handles the case where no email recipients can be found for the principal and email communication is allowed. If email registration is not enabled (per the configured token communication/registration settings), it logs this warning and routes to the error event instead of the registration flow. The user's MFA cannot proceed via email.

Solutions

1. Enable email registration for simple MFA (configure the token communication strategy to allow registration)
2. Map the user's email attribute correctly so recipients resolve (check attribute source and mail settings under cas.authn.mfa.simple)
3. Provide the user an alternative MFA delivery channel (SMS/text) if email is intentionally unavailable
4. Fix the user record to include an email address in the attribute source

Example fix

// before
# no email settings for simple mfa
// after
cas.authn.mfa.simple.mail.from=noreply@example.org
cas.authn.mfa.simple.mail.subject=Your CAS code
cas.authn.mfa.simple.mail.text=Code: ${token}

// Check recipient resolution before entering the MFA send step
boolean hasEmail = communicationStrategy.getCommunicationAddresses(principal, "mail").stream()
    .anyMatch(addr -> addr != null && !addr.isBlank());
if (!hasEmail && !registrationAllowed) {
    // offer alternate channel (SMS) or surface a config warning
}

When it happens

Trigger: A user without an email address on record reaches the simple-MFA send-token step, and the configuration does not permit email address registration, so the action cannot send a code nor offer registration.

Common situations: cas.authn.mfa.simple.mail.* properties missing so no recipients resolve; user's LDAP/attribute source has no email attribute mapped; communicationRoles/registration options configured to disallow email registration.

Related errors

• State [ : : ] does not have a matching transition for
• Not all requested multifactor providers could be found…
• List of candidate multifactor authentication providers is…
• Unknown Duo Security authentication attempt
• Failed to authenticate code

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/4f06a72e091bae98. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-simple-mfa-core/src/main/java/org/apereo/cas/mfa/simple/web/flow/CasSimpleMultifactorSendTokenAction.java:151

    }

    private Event routeToEmailRegistrationFlow(final Principal principal, final Authentication authentication,
                                               final Map<TokenSharingStrategyOptions, List<String>> allRecipients) {
        if (properties.getMail().isRegistrationEnabled()) {
            LOGGER.debug("No recipients found for [{}]", principal.getId());
            val eventAttributes = new LocalAttributeMap<>(CollectionUtils.wrap(
                "principal", principal,
                "authentication", authentication)
            );
            val emailRecipients = allRecipients.get(TokenSharingStrategyOptions.EMAIL);
            if (emailRecipients == null || emailRecipients.isEmpty()) {
                LOGGER.debug("No email recipients found for [{}]", principal.getId());
                eventAttributes.put(EVENT_ATTR_ALLOW_REGISTER_EMAIL, Boolean.TRUE);
            }
            return getEventFactorySupport().event(this, CasWebflowConstants.TRANSITION_ID_REGISTER, eventAttributes);
        }

        LOGGER.warn("Email registration is not enabled for [{}]", principal.getId());
        return routeToErrorEvent();
    }

    private boolean tryToSendEmail(final RequestContext requestContext,
                                   final EnumSet<TokenSharingStrategyOptions> communicationStrategy,
                                   final Principal principal,
                                   final Map<TokenSharingStrategyOptions, List<String>> mapOfAllRecipients,
                                   final CasSimpleMultifactorAuthenticationTicket token) {
        if (communicationStrategy.contains(TokenSharingStrategyOptions.EMAIL) && communicationsManager.isMailSenderDefined()) {
            val cmd = CasSimpleMultifactorSendEmail.of(communicationsManager, properties, tenantExtractor);
            val recipients = cmd.getEmailMessageRecipients(principal, requestContext);

            val currentEvent = requestContext.getCurrentEvent();
            var registeredEmailAddress = StringUtils.EMPTY;
            if (recipients.isEmpty() && currentEvent != null
                && currentEvent.getId().equals(CasWebflowConstants.TRANSITION_ID_RESUME)) {
                registeredEmailAddress = currentEvent.getAttributes().getRequiredString(CasSimpleMultifactorVerifyEmailAction.TOKEN_PROPERTY_EMAIL_TO_REGISTER);
                recipients.add(registeredEmailAddress);

View on GitHub (pinned to e7288fc434)