{"record":{"id":"2b353512002efc16","repo":"apereo/cas","slug":"not-all-requested-multifactor-providers-could-be-f-2b3535","errorCode":null,"errorMessage":"Not all requested multifactor providers could be found. Requested providers are [%s] and resolved providers are [%s]","messagePattern":"Not all requested multifactor providers could be found\\. Requested providers are \\[(.+?)\\] and resolved providers are \\[(.+?)\\]","errorType":"exception","errorClass":"MultifactorAuthenticationProviderAbsentException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-mfa-api/src/main/java/org/apereo/cas/authentication/mfa/trigger/GlobalMultifactorAuthenticationTrigger.java","lineNumber":119,"sourceCode":"            })\n            .filter(providers -> !providers.isEmpty())\n            .orElseGet(() -> {\n                val globalProviderId = casProperties.getAuthn().getMfa().getTriggers().getGlobal().getGlobalProviderId();\n                return StringUtils.commaDelimitedListToSet(globalProviderId);\n            });\n    }\n\n    protected void handleAbsentMultifactorProvider(final Set<String> globalProviderIds,\n                                                   final List<MultifactorAuthenticationProvider> resolvedProviders) {\n        val providerIds = resolvedProviders\n            .stream()\n            .map(MultifactorAuthenticationProvider::getId)\n            .collect(Collectors.joining(\",\"));\n        val message = String.format(\"Not all requested multifactor providers could be found. \"\n            + \"Requested providers are [%s] and resolved providers are [%s]\", globalProviderIds, providerIds);\n        LOGGER.warn(message, globalProviderIds);\n        throw new MultifactorAuthenticationProviderAbsentException(message);\n    }\n\n    protected Optional<MultifactorAuthenticationProvider> resolveSingleMultifactorProvider(\n        final MultifactorAuthenticationProvider resolvedProvider) {\n        LOGGER.debug(\"Resolved single multifactor provider [{}]\", resolvedProvider);\n        return Optional.of(resolvedProvider);\n    }\n\n    protected Optional<MultifactorAuthenticationProvider> resolveMultifactorProvider(\n        final Authentication authentication,\n        final RegisteredService registeredService,\n        final List<MultifactorAuthenticationProvider> resolvedProviders) throws Throwable {\n        val principal = authentication.getPrincipal();\n        val provider = multifactorAuthenticationProviderSelector.resolve(resolvedProviders, registeredService, principal);\n        LOGGER.debug(\"Selected multifactor authentication provider for this transaction is [{}]\", provider);\n        return Optional.ofNullable(provider);\n    }\n}\n","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-mfa-api/src/main/java/org/apereo/cas/authentication/mfa/trigger/GlobalMultifactorAuthenticationTrigger.java#L101-L137","documentation":"GlobalMultifactorAuthenticationTrigger.isActivated found that the globally configured MFA provider ids (cas.authn.mfa.global-provider-id) could not all be resolved against the registered MultifactorAuthenticationProvider selection. handleAbsentMultifactorProvider logs a warning and throws MultifactorAuthenticationProviderAbsentException, failing the flow because a mandated provider is missing.","triggerScenarios":"cas.authn.mfa.global-provider-id lists provider ids (comma-separated) and at least one has no matching registered MultifactorAuthenticationProvider when isActivated runs.","commonSituations":"Typo in global-provider-id; MFA provider module not added to the overlay so its provider bean never registers; provider id changed after a CAS upgrade; provider conditionally disabled by feature toggle.","solutions":["Correct the provider ids in cas.authn.mfa.global-provider-id to match registered provider beans (e.g., mfa-simple, mfa-duo)","Add the missing MFA provider module/dependency and enable its feature so the provider registers","Log available provider ids (the warning shows resolved providers) and align config with that list"],"exampleFix":"// before\ncas.authn.mfa.global-provider-id=mfa-gauth,mfa-duoo\n// after\ncas.authn.mfa.global-provider-id=mfa-gauth,mfa-duo","handlingStrategy":"try-catch","validationCode":"var resolved = providerSelector.getAvailableProviders(); var missing = globalIds.stream().filter(id -> resolved.stream().noneMatch(p -> p.getId().equals(id))).toList(); if (!missing.isEmpty()) { /* fix config before login */ }","typeGuard":null,"tryCatchPattern":"try { mfaTrigger.isActivated(...); } catch (MultifactorAuthenticationProviderAbsentException e) { log.error(\"configured MFA provider missing: {}\", e.getMessage()); }","preventionTips":["Cross-check global-provider-id values against resolved provider list at startup","Add MFA provider modules to the overlay explicitly","Re-verify provider ids after CAS upgrades"],"tags":["mfa","multifactor","provider-absent","misconfiguration","trigger"],"backgroundTag":"entity-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}