{"record":{"id":"4ec73db30ef0da19","repo":"passbolt/passbolt_api","slug":"no-configuration-set-for-yubikey-otp-clientid","errorCode":null,"errorMessage":"No configuration set for Yubikey OTP clientId.","messagePattern":"No configuration set for Yubikey OTP clientId\\.","errorType":"exception","errorClass":"RecordNotFoundException","httpStatus":404,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php","lineNumber":49,"sourceCode":"    public function getYubikeyOTPSecretKey(): string\n    {\n        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY])) {\n            throw new RecordNotFoundException(__('No configuration set for Yubikey OTP secret key.'));\n        }\n\n        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY];\n    }\n\n    /**\n     * getYubikeyOTPClientId\n     *\n     * @throw RecordNotFoundException if config is missing\n     * @return string\n     */\n    public function getYubikeyOTPClientId(): string\n    {\n        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID])) {\n            throw new RecordNotFoundException(__('No configuration set for Yubikey OTP clientId.'));\n        }\n\n        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID];\n    }\n\n    /**\n     * validateYubikeySettings\n     *\n     * @throw CustomValidationException if there is an issue\n     * @param array $data user provider data\n     * @return void\n     */\n    public function validateYubikeySettings(array $data): void\n    {\n        $errors = [];\n\n        if (!isset($data[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID])) {\n            $msg = __('No configuration set for Yubikey OTP clientId.');","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php#L31-L67","documentation":"getYubikeyOTPClientId() (MfaOrgSettingsYubikeyTrait) returns the organization-level Yubikey API client ID. It throws RecordNotFoundException when org settings have no yubikey.clientId entry, meaning the Yubikey org configuration lacks the credentials needed for the YubiCo OTP verification service.","triggerScenarios":"Calling getYubikeyOTPClientId() when org settings lack MfaOrgSettings::YUBIKEY_CLIENT_ID under the yubikey provider — org Yubikey never configured, partially saved, or clientId dropped during settings update.","commonSituations":"Yubikey login verification failing on instances where only the secretKey was configured but not the clientId; config not carried over after migration/redeployment; admin saved settings with clientId left blank; tests missing yubikey org fixtures.","solutions":["Set the org Yubikey clientId via admin MFA org settings (or passbolt.php / YUBICO_OTP_CLIENT_ID env) and save the settings.","Catch RecordNotFoundException and skip/ disable Yubikey verification with a clear message when org credentials are absent.","Verify both clientId and secretKey are saved together when configuring org Yubikey.","Check the stored OrganizationSettings payload includes yubikey.clientId after any settings migration."],"exampleFix":"// before\n$clientId = $mfaOrgSettings->getYubikeyOTPClientId();\n// after\ntry {\n    $clientId = $mfaOrgSettings->getYubikeyOTPClientId();\n} catch (\\Cake\\Datasource\\Exception\\RecordNotFoundException $e) {\n    throw new InternalErrorException('Yubikey org settings are incomplete.');\n}","handlingStrategy":"try-catch","validationCode":"$configured = isset($orgSettings->toArray()['yubikey'][MfaOrgSettings::YUBIKEY_CLIENT_ID]);","typeGuard":null,"tryCatchPattern":"try { $id = $orgSettings->getYubikeyOTPClientId(); } catch (\\Cake\\Datasource\\Exception\\RecordNotFoundException $e) { /* disable yubikey provider or error out */ }","preventionTips":["Configure clientId and secretKey as a pair and validate both before saving","Carry yubikey org settings over during migrations and environment rebuilds","Gate Yubikey login attempts on org settings presence to give clear errors"],"tags":["mfa","yubikey","org-settings","missing-config"],"backgroundTag":"missing-config-key","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}