{"record":{"id":"1f30abea7fa7175a","repo":"passbolt/passbolt_api","slug":"could-not-validate-yubikey-configuration","errorCode":null,"errorMessage":"Could not validate Yubikey configuration.","messagePattern":"Could not validate Yubikey configuration\\.","errorType":"validation","errorClass":"CustomValidationException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php","lineNumber":90,"sourceCode":"                $msg = __('Yubikey OTP clientId should be an integer.');\n                $errors[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID]['isValidClientId'] = $msg;\n            }\n        }\n\n        if (!isset($data[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY])) {\n            $msg = __('No configuration set for Yubikey OTP secret key.');\n            $errors[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY]['notEmpty'] = $msg;\n        } else {\n            $secretKey = $data[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY];\n            if (!Validation::custom($secretKey, '/^[a-zA-Z0-9\\/=\\+]{10,128}$/')) {\n                $msg = __('Yubikey OTP secret key is not valid.');\n                $errors[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY]['isValidSecretKey'] = $msg;\n            }\n        }\n\n        if (count($errors) !== 0) {\n            $msg = __('Could not validate Yubikey configuration.');\n            throw new CustomValidationException($msg, $errors);\n        }\n    }\n}\n","sourceCodeStart":72,"sourceCodeEnd":94,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php#L72-L94","documentation":"Thrown by validateYubikeySettings when the organization-level MFA Yubikey settings fail validation. It collects per-field validation errors into a CustomValidationException so the API client can see exactly which fields (e.g. clientId, secretKey) are wrong.","triggerScenarios":"An administrator POSTs MFA organization settings with a Yubikey client id or secret key that fails the form validation rules (empty, wrong format, or non-numeric client id).","commonSituations":"Admins copy-pasting the Yubikey client secret with extra whitespace, swapping the client id and secret key fields, or leaving one of the two fields blank in the MFA policy settings form.","solutions":["Check the errors payload in the exception for the exact failing field (MfaOrgSettings::PROVIDER_YUBIKEY -> clientId/secretKey).","Ensure the Yubikey client id is a valid integer and the secret key is the correct value from the Yubico API dashboard.","Trim whitespace/quotes when pasting credentials into the settings JSON/form.","Retry saving the organization settings after correcting the fields."],"exampleFix":"// before\n{\"providers\": {\"yubikey\": {\"clientId\": \"\", \"secretKey\": \"abc\"}}}\n// after\n{\"providers\": {\"yubikey\": {\"clientId\": \"12345\", \"secretKey\": \"correct-secret-from-yubico\"}}}","handlingStrategy":"validation","validationCode":"if (!is_numeric($data['yubikey']['clientId']) || empty($data['yubikey']['secretKey'])) { // reject before POST }","typeGuard":null,"tryCatchPattern":"try { $api->saveMfaOrgSettings($payload); } catch (CustomValidationException $e) { $errors = $e->getErrors(); }","preventionTips":["Copy client id/secret exactly from the Yubico dashboard, trimmed of whitespace.","Validate client id is an integer before submission.","Test Yubikey credentials against the Yubico verification API before saving."],"tags":["validation","mfa","yubikey"],"backgroundTag":"schema-validation-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}