{"record":{"id":"3ca239b26283b445","repo":"gravitational/teleport","slug":"all-mfa-devices-failed","errorCode":null,"errorMessage":"all MFA devices failed","messagePattern":"all MFA devices failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/webauthncli/fido2.go","lineNumber":727,"sourceCode":"\t// First \"interactive\" response wins.\n\tfor receiveCount < devices.len() {\n\t\tselect {\n\t\tcase err := <-devicesC:\n\t\t\treceiveCount++\n\n\t\t\t// Keep going on cancels or non-interactive errors.\n\t\t\tif errors.Is(err, libfido2.ErrKeepaliveCancel) || errors.Is(err, &nonInteractiveError{}) {\n\t\t\t\tfidoLog.DebugContext(ctx, \"Got cancel or non-interactive device error\", \"error\", err)\n\t\t\t\tcontinue\n\t\t\t}\n\n\t\t\treturn trace.Wrap(err)\n\n\t\tcase <-ctx.Done():\n\t\t\treturn trace.Wrap(ctx.Err())\n\t\t}\n\t}\n\treturn trace.Wrap(errors.New(\"all MFA devices failed\"))\n}\n\nfunc startDevices(\n\tlocs []*libfido2.DeviceLocation,\n\tfilter deviceFilterFunc,\n\tdeviceCallback deviceCallbackFunc,\n\tprompt runPrompt,\n) (devices *openedDevices, devicesC <-chan error, err error) {\n\tfidoDevs := make([]FIDODevice, 0, len(locs))\n\topenDevs := make([]*openedDevice, 0, len(locs))\n\n\t// closeAll should only be used until the devices are handed over.\n\t// Do not defer-call it.\n\tcloseAll := func() {\n\t\tfor i, dev := range fidoDevs {\n\t\t\tpath := openDevs[i].path\n\t\t\terr := dev.Close()\n\t\t\tfidoLog.DebugContext(context.Background(), \"Close device\",","sourceCodeStart":709,"sourceCodeEnd":745,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/webauthncli/fido2.go#L709-L745","documentation":"runOnFIDO2Devices waits for a result from every connected MFA device; this sentinel is returned only when the loop exhausts all devices without producing a usable result — in practice because every device reported libfido2.ErrKeepaliveCancel or a nonInteractiveError, which are deliberately skipped.","triggerScenarios":"Thrown at lib/auth/webauthncli/fido2.go:727 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Tap the security key when prompted instead of cancelling/retrying","If a non-interactive device (e.g. a platform authenticator in a headless flow) keeps failing, unplug it or use a device filter","Retry the login or registration"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}