{"record":{"id":"12d79fdd235ed27d","repo":"theonedev/onedev","slug":"two-factor-authentication-not-enabled-12d79f","errorCode":null,"errorMessage":"Two-factor authentication not enabled","messagePattern":"Two-factor authentication not enabled","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/web/page/user/twofactorauthentication/UserTwoFactorAuthenticationPage.java","lineNumber":25,"sourceCode":"\nimport static io.onedev.server.model.User.Type.ORDINARY;\n\nimport org.apache.wicket.request.mapper.parameter.PageParameters;\n\npublic class UserTwoFactorAuthenticationPage extends UserPage {\n\n\tpublic UserTwoFactorAuthenticationPage(PageParameters params) {\n\t\tsuper(params);\n\t\tif (getUser().getType() != ORDINARY || getUser().isDisabled())\n\t\t\tthrow new IllegalStateException();\n\t}\n\t\n\t@Override\n\tprotected void onInitialize() {\n\t\tsuper.onInitialize();\n\n\t\tif (!getUser().isEnforce2FA())\n\t\t\tthrow new ExplicitException(\"Two-factor authentication not enabled\");\n\n\t\tadd(new TwoFactorAuthenticationStatusPanel(\"content\") {\n\t\t\t@Override\n\t\t\tprotected User getUser() {\n\t\t\t\treturn UserTwoFactorAuthenticationPage.this.getUser();\n\t\t\t}\n\t\t});\n\t}\n\n}\n","sourceCodeStart":7,"sourceCodeEnd":36,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/page/user/twofactorauthentication/UserTwoFactorAuthenticationPage.java#L7-L36","documentation":"UserTwoFactorAuthenticationPage manages a user's 2FA configuration and is only meaningful when 2FA enforcement is on. In onInitialize it checks getUser().isEnforce2FA() and throws this ExplicitException if the user does not have two-factor authentication enforced, since there is nothing to configure or display.","triggerScenarios":"Opening the two-factor authentication page (direct URL or menu link) for a user whose enforce2FA flag is false.","commonSituations":"An administrator bookmarks the 2FA page; server-wide 2FA enforcement was turned off but the link remains in a saved bookmark; navigating to another user's 2FA settings who is not covered by the enforcement policy.","solutions":["Enable two-factor authentication enforcement for the user (Admin > Users > user > enable 2FA / enforce 2FA) before opening the page.","If 2FA was intentionally disabled, remove the bookmark/link to this page — it is not applicable.","Check the server-level 2FA policy; if policy changed recently, update user flags accordingly."],"exampleFix":"// before: direct navigation\nGET /~admin/users/john/two-factor-authentication\n\n// after: enable enforcement first\nAdmin -> Users -> john -> Two-factor authentication -> Enable","handlingStrategy":"validation","validationCode":"// Only link/open the 2FA page when enforcement is on\nif (user.isEnforce2FA()) {\n    // safe to navigate to UserTwoFactorAuthenticationPage\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Hide 2FA settings links for users without enforced 2FA.","Enable server-wide 2FA policy if all users need the page.","Remove outdated bookmarks after changing 2FA policy."],"tags":["two-factor-authentication","security","page"],"backgroundTag":"feature-not-enabled","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}