{"record":{"id":"2f0558d0a7157f07","repo":"apereo/cas","slug":"no-registered-devices-for-multifactor-authenticati","errorCode":null,"errorMessage":"No registered devices for multifactor authentication could be found for [{}] via [{}]","messagePattern":"No registered devices for multifactor authentication could be found for \\[(.+?)\\] via \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/InitPasswordResetAction.java","lineNumber":61,"sourceCode":"    private final MultifactorAuthenticationProviderSelector multifactorAuthenticationProviderSelector;\n    private final AuthenticationSystemSupport authenticationSystemSupport;\n    private final MultifactorAuthenticationContextValidator multifactorAuthenticationContextValidator;\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {\n        val username = getPasswordResetUsername(requestContext);\n        if (StringUtils.isBlank(username)) {\n            LOGGER.error(\"Password reset token could not be verified to determine username\");\n            return error();\n        }\n\n        if (doesPasswordResetRequireMultifactorAuthentication(requestContext)) {\n            val resolvedPrincipal = resolvedPrincipal(username);\n            val provider = selectMultifactorAuthenticationProvider(requestContext, resolvedPrincipal);\n            if (!doesMultifactorAuthenticationProviderExistInContext(requestContext, provider)) {\n                val deviceManager = provider.getDeviceManager();\n                if (deviceManager != null && !deviceManager.hasRegisteredDevices(resolvedPrincipal)) {\n                    LOGGER.warn(\"No registered devices for multifactor authentication could be found for [{}] via [{}]\", resolvedPrincipal.getId(), provider.getId());\n                    return error();\n                }\n                return routeToMultifactorAuthenticationProvider(requestContext, resolvedPrincipal, provider);\n            }\n        }\n        val credential = new UsernamePasswordCredential();\n        credential.setUsername(username);\n        WebUtils.putCredential(requestContext, credential);\n        return success();\n    }\n\n    protected Event routeToMultifactorAuthenticationProvider(final RequestContext requestContext,\n                                                             final Principal resolvedPrincipal,\n                                                             final MultifactorAuthenticationProvider provider) {\n        val authentication = DefaultAuthenticationBuilder.newInstance().setPrincipal(resolvedPrincipal).build();\n        WebUtils.putAuthentication(authentication, requestContext);\n        val builder = authenticationSystemSupport.getAuthenticationResultBuilderFactory().newBuilder();\n        val authenticationResult = builder.collect(authentication);","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/InitPasswordResetAction.java#L43-L79","documentation":"InitPasswordResetAction checks, when password reset requires MFA, whether the resolved principal has registered devices with the selected MFA provider's device manager. If none exist, it warns 'No registered devices for multifactor authentication could be found for [{}] via [{}]' and returns the error event, halting password reset.","triggerScenarios":"User starts password reset; password-management policy requires MFA; the resolved MFA provider (e.g. WebAuthn) is selected but its DeviceManager reports no registered devices for that principal.","commonSituations":"Users who never enrolled a device (e.g. no WebAuthn credential) trying to reset passwords, or MFA provider misconfiguration selecting a provider the user has no devices for; also occurs after device deregistration.","solutions":["Have the user enroll a device with the MFA provider before attempting password reset","Configure password management so reset MFA falls back to an alternative provider (or a fallback channel) when no devices exist","Review cas.pm.reset.mfa / multifactor provider selection policy for the account","Verify the device manager is backed by the correct registration storage (data source) so existing devices are found"],"exampleFix":"// before\ncas.pm.reset.mfa.webflow-enabled=true  # no fallback, user has no devices\n// after  # enable fallback via a secondary provider or allow security questions\ncas.pm.reset.security-questions-enabled=true","handlingStrategy":"fallback","validationCode":"if (provider.getDeviceManager() != null && !provider.getDeviceManager().hasRegisteredDevices(principal)) {\n    // fall back to alternate reset channel before entering the flow\n}","typeGuard":null,"tryCatchPattern":"try { selectMultifactorAuthenticationProvider(...); } catch (Exception e) { LOGGER.warn(\"MFA provider selection failed\", e); return alternateResetChannel(); }","preventionTips":["Configure a fallback MFA provider for password reset","Guide users to enroll devices during onboarding","Verify device-manager storage connectivity","Alert when users with reset MFA enabled have zero registered devices"],"tags":["password-management","mfa","device-registration"],"backgroundTag":"empty-result-set","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}