{"record":{"id":"58ea0b340a71b36c","repo":"apereo/cas","slug":"multifactorauthenticationproviderabsentexception","errorCode":null,"errorMessage":"MultifactorAuthenticationProviderAbsentException","messagePattern":"MultifactorAuthenticationProviderAbsentException","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"critical","filePath":"support/cas-server-support-radius/src/main/java/org/apereo/cas/adaptors/radius/web/flow/RadiusAccessChallengedMultifactorAuthenticationTrigger.java","lineNumber":61,"sourceCode":"    @Override\n    public Optional<MultifactorAuthenticationProvider> isActivated(final Authentication authentication,\n                                                                   final RegisteredService registeredService,\n                                                                   final HttpServletRequest request,\n                                                                   final HttpServletResponse response,\n                                                                   final Service service) {\n        if (authentication == null) {\n            LOGGER.debug(\"No authentication or service is available to determine event for principal\");\n            return Optional.empty();\n        }\n        if (!supports(authentication)) {\n            LOGGER.trace(\"Authentication attempt does not qualify for radius multifactor authentication\");\n            return Optional.empty();\n        }\n        \n        val providerMap = MultifactorAuthenticationUtils.getAvailableMultifactorAuthenticationProviders(this.applicationContext);\n        if (providerMap.isEmpty()) {\n            LOGGER.error(\"No multifactor authentication providers are available in the application context\");\n            throw new AuthenticationException(new MultifactorAuthenticationProviderAbsentException());\n        }\n\n        val id = casProperties.getAuthn().getMfa().getRadius().getId();\n        LOGGER.debug(\"Authentication requires multifactor authentication via provider [{}]\", id);\n        return MultifactorAuthenticationUtils.resolveProvider(providerMap, id);\n\n    }\n\n    private static boolean supports(final Authentication authentication) {\n        val principal = authentication.getPrincipal();\n        val attributes = principal.getAttributes();\n        LOGGER.debug(\"Evaluating principal attributes [{}] for multifactor authentication\", attributes.keySet());\n        return attributes.containsKey(Attr_ReplyMessage.NAME) && attributes.containsKey(Attr_State.NAME);\n    }\n}\n","sourceCodeStart":43,"sourceCodeEnd":77,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-radius/src/main/java/org/apereo/cas/adaptors/radius/web/flow/RadiusAccessChallengedMultifactorAuthenticationTrigger.java#L43-L77","documentation":"RadiusAccessChallengedMultifactorAuthenticationTrigger.isActivated throws AuthenticationException wrapping MultifactorAuthenticationProviderAbsentException when it needs to resolve the RADIUS MFA provider but the application context has no registered multifactor authentication providers at all. The RADIUS access-challenge flow cannot be activated without an MFA provider.","triggerScenarios":"A RADIUS access challenge (State packet) is detected during authentication, the trigger runs, and MultifactorAuthenticationUtils.getAvailableMultifactorAuthenticationProviders(applicationContext) returns an empty map.","commonSituations":"cas-server-support-radius-mfa module not on the classpath so no provider bean is registered; all MFA providers excluded/disabled by feature flags; the radius MFA provider bean failed to initialize (missing RADIUS server config); running a webapp assembly that omits MFA auto-configuration.","solutions":["Add the radius-mfa support module (cas-server-support-radius-mfa) to the build so the provider bean is registered","Confirm no MFA feature flags/exclusions are disabling the radius provider (@ConditionalOnFeatureEnabled)","Check startup logs for the MFA provider bean failing to create (missing cas.authn.mfa.radius config)","Verify the application context actually contains a bean implementing MultifactorAuthenticationProvider"],"exampleFix":"// before: build.gradle (webapp overlay) missing MFA module\n// implementation 'org.apereo.cas:cas-server-support-radius'\n// after\nimplementation 'org.apereo.cas:cas-server-support-radius'\nimplementation 'org.apereo.cas:cas-server-support-radius-mfa'","handlingStrategy":"validation","validationCode":"var providers = MultifactorAuthenticationUtils\n    .getAvailableMultifactorAuthenticationProviders(applicationContext);\nif (providers.isEmpty()) {\n    throw new IllegalStateException(\"No MFA providers registered; radius-mfa module missing\");\n}","typeGuard":"boolean radiusMfaReady(ApplicationContext ctx) {\n    return !MultifactorAuthenticationUtils\n        .getAvailableMultifactorAuthenticationProviders(ctx)\n        .isEmpty();\n}","tryCatchPattern":"try {\n    trigger.isActivated(...);\n} catch (AuthenticationException e) {\n    // abort challenge flow; radius-mfa provider not present\n}","preventionTips":["Include cas-server-support-radius-mfa in the deployment","Smoke-test provider availability at startup","Do not exclude MFA auto-configurations when RADIUS challenges are expected"],"tags":["mfa","radius","configuration","cas"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}