apereo/cas · warning

Passwordless account

Error message

Passwordless account [{}] does not allow multifactor authentication

What it means

AcceptPasswordlessSelectionMenuAction rejects the MFA menu option when shouldActivateMultifactorAuthenticationFor is false; CAS logs this warning and returns an error event. Multifactor authentication is not available/triggered for this passwordless account in the current request.

Solutions

1. Verify the MFA provider is configured and enabled (cas.authn.mfa.*)
2. Check MFA trigger conditions resolve true for this user/service
3. Confirm the passwordless account's allowed options include MFA
4. Have the user choose another option or reload the selection menu

Example fix

null

if (selection == PasswordlessSelectionMenu.MFA && !mfaTriggers.evaluate(principal, service)) renderMenuAgain(account);

When it happens

Trigger: User selects MFA in the passwordless selection menu while no MFA provider is eligible (provider not configured, trigger conditions unmet, or account not enrolled) for the requestContext.

Common situations: MFA module not enabled or provider misconfigured; MFA trigger (e.g. global/provider trigger) does not activate for this principal; user selects a stale menu option; service excluded from MFA.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• State [ : : ] does not have a matching transition for
• Unknown Duo Security authentication attempt
• Failed to authenticate code
• Unauthorized account registration attempt for id
• Failed to authenticate code

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/843d0cebb3158919. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java:55

    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {
        val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));

        if (!user.isAllowSelectionMenu()) {
            LOGGER.error("Passwordless account [{}] is not allowed to select options", user.getUsername());
            return buildErrorEvent(requestContext);
        }

        val selection = extractSelectedAuthenticationOption(requestContext);
        if (selection == PasswordlessSelectionMenu.PASSWORD && !doesPasswordlessAccountRequestPassword(user)) {
            LOGGER.warn("Passwordless account [{}] does not require a password", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        if (selection == PasswordlessSelectionMenu.DELEGATION && !isDelegatedAuthenticationActiveFor(requestContext, user)) {
            LOGGER.warn("Passwordless account [{}] does not allow delegated authentication", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        if (selection == PasswordlessSelectionMenu.MFA && !shouldActivateMultifactorAuthenticationFor(requestContext, user)) {
            LOGGER.warn("Passwordless account [{}] does not allow multifactor authentication", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        return buildFinalSelectionEvent(requestContext, selection);
    }

    protected Event buildFinalSelectionEvent(final RequestContext requestContext, final PasswordlessSelectionMenu selection) {
        val finalEvent = switch (selection) {
            case PASSWORD -> {
                val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));
                WebUtils.putCasLoginFormViewable(requestContext, doesPasswordlessAccountRequestPassword(user));
                yield CasWebflowConstants.TRANSITION_ID_PROMPT;
            }
            case TOKEN -> CasWebflowConstants.TRANSITION_ID_DISPLAY;
            case MFA -> CasWebflowConstants.TRANSITION_ID_MFA;
            case DELEGATION -> CasWebflowConstants.TRANSITION_ID_DELEGATED_AUTHENTICATION_REDIRECT;
        };

        return eventFactory.event(this, finalEvent);

View on GitHub (pinned to e7288fc434)