{"record":{"id":"5bf93a56d7dcd267","repo":"passbolt/passbolt_api","slug":"no-configuration-set-for-yubikey-otp-secret-key","errorCode":null,"errorMessage":"No configuration set for Yubikey OTP secret key.","messagePattern":"No configuration set for Yubikey OTP secret key\\.","errorType":"exception","errorClass":"RecordNotFoundException","httpStatus":404,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php","lineNumber":34,"sourceCode":" */\nnamespace Passbolt\\MultiFactorAuthentication\\Utility;\n\nuse App\\Error\\Exception\\CustomValidationException;\nuse Cake\\Datasource\\Exception\\RecordNotFoundException;\nuse Cake\\Validation\\Validation;\n\ntrait MfaOrgSettingsYubikeyTrait\n{\n    /**\n     * getYubikeyOTPSecretKey\n     *\n     * @throw RecordNotFoundException if config is missing\n     * @return string\n     */\n    public function getYubikeyOTPSecretKey(): string\n    {\n        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY])) {\n            throw new RecordNotFoundException(__('No configuration set for Yubikey OTP secret key.'));\n        }\n\n        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY];\n    }\n\n    /**\n     * getYubikeyOTPClientId\n     *\n     * @throw RecordNotFoundException if config is missing\n     * @return string\n     */\n    public function getYubikeyOTPClientId(): string\n    {\n        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID])) {\n            throw new RecordNotFoundException(__('No configuration set for Yubikey OTP clientId.'));\n        }\n\n        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID];","sourceCodeStart":16,"sourceCodeEnd":52,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php#L16-L52","documentation":"getYubikeyOTPSecretKey() (MfaOrgSettingsYubikeyTrait) returns the organization-level Yubikey OTP secret key used to authenticate against the YubiCo API. It throws RecordNotFoundException when org settings have no yubikey.secretKey entry, i.e. the Yubikey org configuration is incomplete.","triggerScenarios":"Calling getYubikeyOTPSecretKey() when org settings contain no MfaOrgSettings::YUBIKEY_SECRET_KEY under the yubikey provider — org-level Yubikey never configured or saved without the secretKey field.","commonSituations":"Users attempting Yubikey MFA login on an instance where the admin never saved the Yubikey org secretKey; secretKey removed after org settings edit; environment-specific config (passbolt.php or env var) missing after redeploy; reading settings in tests without fixtures.","solutions":["Configure the org Yubikey secretKey via admin MFA org settings or config (passbolt.php / YUBICO_OTP_SECRET_KEY env) and save.","Check isset(orgSettings yubikey secretKey) or catch RecordNotFoundException before attempting Yubikey verification and disable the provider in that case.","Ensure the deployment environment variables for YubiCo are set on the server.","If org Yubikey should be disabled, remove yubikey from the org providers list so login flows don't probe its config."],"exampleFix":"// before\n$secretKey = $mfaOrgSettings->getYubikeyOTPSecretKey();\n// after\ntry {\n    $secretKey = $mfaOrgSettings->getYubikeyOTPSecretKey();\n} catch (\\Cake\\Datasource\\Exception\\RecordNotFoundException $e) {\n    throw new InternalErrorException('Yubikey org settings are incomplete.');\n}","handlingStrategy":"try-catch","validationCode":"$configured = isset($orgSettings->toArray()['yubikey'][MfaOrgSettings::YUBIKEY_SECRET_KEY]);","typeGuard":null,"tryCatchPattern":"try { $key = $orgSettings->getYubikeyOTPSecretKey(); } catch (\\Cake\\Datasource\\Exception\\RecordNotFoundException $e) { /* disable yubikey provider or error out */ }","preventionTips":["Save both yubikey clientId and secretKey together during org configuration","Set the YUBICO env vars / passbolt.php config on every deployment","Skip Yubikey verification flows when org settings for yubikey are absent"],"tags":["mfa","yubikey","org-settings","missing-config"],"backgroundTag":"missing-config-key","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}