{"record":{"id":"4f06a72e091bae98","repo":"apereo/cas","slug":"email-registration-is-not-enabled-for","errorCode":null,"errorMessage":"Email registration is not enabled for [{}]","messagePattern":"Email registration is not enabled for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-simple-mfa-core/src/main/java/org/apereo/cas/mfa/simple/web/flow/CasSimpleMultifactorSendTokenAction.java","lineNumber":151,"sourceCode":"    }\n\n    private Event routeToEmailRegistrationFlow(final Principal principal, final Authentication authentication,\n                                               final Map<TokenSharingStrategyOptions, List<String>> allRecipients) {\n        if (properties.getMail().isRegistrationEnabled()) {\n            LOGGER.debug(\"No recipients found for [{}]\", principal.getId());\n            val eventAttributes = new LocalAttributeMap<>(CollectionUtils.wrap(\n                \"principal\", principal,\n                \"authentication\", authentication)\n            );\n            val emailRecipients = allRecipients.get(TokenSharingStrategyOptions.EMAIL);\n            if (emailRecipients == null || emailRecipients.isEmpty()) {\n                LOGGER.debug(\"No email recipients found for [{}]\", principal.getId());\n                eventAttributes.put(EVENT_ATTR_ALLOW_REGISTER_EMAIL, Boolean.TRUE);\n            }\n            return getEventFactorySupport().event(this, CasWebflowConstants.TRANSITION_ID_REGISTER, eventAttributes);\n        }\n\n        LOGGER.warn(\"Email registration is not enabled for [{}]\", principal.getId());\n        return routeToErrorEvent();\n    }\n\n    private boolean tryToSendEmail(final RequestContext requestContext,\n                                   final EnumSet<TokenSharingStrategyOptions> communicationStrategy,\n                                   final Principal principal,\n                                   final Map<TokenSharingStrategyOptions, List<String>> mapOfAllRecipients,\n                                   final CasSimpleMultifactorAuthenticationTicket token) {\n        if (communicationStrategy.contains(TokenSharingStrategyOptions.EMAIL) && communicationsManager.isMailSenderDefined()) {\n            val cmd = CasSimpleMultifactorSendEmail.of(communicationsManager, properties, tenantExtractor);\n            val recipients = cmd.getEmailMessageRecipients(principal, requestContext);\n\n            val currentEvent = requestContext.getCurrentEvent();\n            var registeredEmailAddress = StringUtils.EMPTY;\n            if (recipients.isEmpty() && currentEvent != null\n                && currentEvent.getId().equals(CasWebflowConstants.TRANSITION_ID_RESUME)) {\n                registeredEmailAddress = currentEvent.getAttributes().getRequiredString(CasSimpleMultifactorVerifyEmailAction.TOKEN_PROPERTY_EMAIL_TO_REGISTER);\n                recipients.add(registeredEmailAddress);","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-simple-mfa-core/src/main/java/org/apereo/cas/mfa/simple/web/flow/CasSimpleMultifactorSendTokenAction.java#L133-L169","documentation":"CasSimpleMultifactorSendTokenAction.routeToEmailRegistrationFlow() handles the case where no email recipients can be found for the principal and email communication is allowed. If email registration is not enabled (per the configured token communication/registration settings), it logs this warning and routes to the error event instead of the registration flow. The user's MFA cannot proceed via email.","triggerScenarios":"A user without an email address on record reaches the simple-MFA send-token step, and the configuration does not permit email address registration, so the action cannot send a code nor offer registration.","commonSituations":"cas.authn.mfa.simple.mail.* properties missing so no recipients resolve; user's LDAP/attribute source has no email attribute mapped; communicationRoles/registration options configured to disallow email registration.","solutions":["Enable email registration for simple MFA (configure the token communication strategy to allow registration)","Map the user's email attribute correctly so recipients resolve (check attribute source and mail settings under cas.authn.mfa.simple)","Provide the user an alternative MFA delivery channel (SMS/text) if email is intentionally unavailable","Fix the user record to include an email address in the attribute source"],"exampleFix":"// before\n# no email settings for simple mfa\n// after\ncas.authn.mfa.simple.mail.from=noreply@example.org\ncas.authn.mfa.simple.mail.subject=Your CAS code\ncas.authn.mfa.simple.mail.text=Code: ${token}","handlingStrategy":"fallback","validationCode":"// Check recipient resolution before entering the MFA send step\nboolean hasEmail = communicationStrategy.getCommunicationAddresses(principal, \"mail\").stream()\n    .anyMatch(addr -> addr != null && !addr.isBlank());\nif (!hasEmail && !registrationAllowed) {\n    // offer alternate channel (SMS) or surface a config warning\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure cas.authn.mfa.simple mail settings (from/subject/text) in all environments","Ensure the attribute source reliably provides the email attribute","Enable the email registration option if users may lack emails on first login","Offer a secondary delivery channel (text/SMS) for users without email"],"tags":["mfa","email","webflow","configuration"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}