{"record":{"id":"5063b0f5b227c52e","repo":"phacility/phabricator","slug":"duo-username-pairing-mode-s-is-not-supported","errorCode":null,"errorMessage":"Duo username pairing mode (\"%s\") is not supported.","messagePattern":"Duo username pairing mode \\(\"(.+?)\"\\) is not supported\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/auth/factor/PhabricatorDuoAuthFactor.php","lineNumber":771,"sourceCode":"      ->setIntegrationKey($duo_key)\n      ->setSecretKey($duo_secret)\n      ->setAPIHostname($duo_host)\n      ->setTimeout(10)\n      ->setHTTPMethod('POST');\n  }\n\n  private function getDuoUsername(\n    PhabricatorAuthFactorProvider $provider,\n    PhabricatorUser $user) {\n\n    $mode = $provider->getAuthFactorProviderProperty(self::PROP_USERNAMES);\n    switch ($mode) {\n      case 'username':\n        return $user->getUsername();\n      case 'email':\n        return $user->loadPrimaryEmailAddress();\n      default:\n        throw new Exception(\n          pht(\n            'Duo username pairing mode (\"%s\") is not supported.',\n            $mode));\n    }\n  }\n\n  private function shouldAllowDuoEnrollment(\n    PhabricatorAuthFactorProvider $provider) {\n\n    $mode = $provider->getAuthFactorProviderProperty(self::PROP_ENROLL);\n    switch ($mode) {\n      case 'deny':\n        return false;\n      case 'allow':\n        return true;\n      default:\n        throw new Exception(\n          pht(","sourceCodeStart":753,"sourceCodeEnd":789,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/factor/PhabricatorDuoAuthFactor.php#L753-L789","documentation":"PhabricatorDuoAuthFactor::getDuoUsername() maps the provider property 'duo.usernames' to the Duo-side username; only 'username' (Phabricator username) and 'email' (primary email address) are implemented, matching the provider edit form's select options. Any other value falls through to default and throws whenever the factor needs to pair a Phabricator user to a Duo user.","triggerScenarios":"The duo.usernames provider property contains a value other than 'username'/'email' — hand-edited database, config imported from a different Phabricator version or fork, or a custom extension writing an unsupported value. Thrown during enrollment pairing and challenge issuance.","commonSituations":"Editing auth_factor_provider properties JSON directly; restoring a dump from a fork that had extra modes; custom patches adding a mode that stored data references but this code version does not implement.","solutions":["Edit the Duo provider in the UI and re-save the 'Duo Username' select (Use Platform Username or Use Primary Email Address).","Inspect the provider properties and reset duo.usernames to 'username' or 'email'.","If the record cannot be repaired, delete and recreate the provider (users re-enroll)."],"exampleFix":"// before: hand-edited provider property\n\"duo.usernames\": \"userName\"\n// after: one of the two supported values\n\"duo.usernames\": \"username\"","handlingStrategy":"validation","validationCode":"// Run when saving the provider config.\n$mode = $provider->getAuthFactorProviderProperty(\n  PhabricatorDuoAuthFactor::PROP_USERNAMES);\nif (!in_array($mode, array('username', 'email'), true)) {\n  // reject the save; only these two pairing modes are implemented\n}","typeGuard":"function isSupportedDuoUsernameMode($mode) {\n  return in_array($mode, array('username', 'email'), true);\n}","tryCatchPattern":null,"preventionTips":["Change provider settings only through the edit UI, never by editing stored properties directly.","After DB migrations or restores, smoke-test each MFA provider.","Keep custom patches and stored config values in sync."],"tags":["duo","provider-config","phabricator","config-value"],"backgroundTag":"invalid-config-value","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}