{"record":{"id":"5e44174a529f5364","repo":"apereo/cas","slug":"device-registration-is-disabled-for","errorCode":null,"errorMessage":"Device registration is disabled for [{}]","messagePattern":"Device registration is disabled for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-otp-mfa-core/src/main/java/org/apereo/cas/otp/web/flow/OneTimeTokenAccountSaveRegistrationAction.java","lineNumber":73,"sourceCode":"            .validationCode(currentAcct.getValidationCode())\n            .scratchCodes(currentAcct.getScratchCodes())\n            .name(accountName)\n            .tenant(tenantExtractor.extract(requestContext).map(TenantDefinition::getId).orElse(StringUtils.EMPTY))\n            .build();\n    }\n\n    protected T getCandidateAccountFrom(final RequestContext requestContext) {\n        return (T) requestContext.getFlowScope()\n            .get(OneTimeTokenAccountCreateRegistrationAction.FLOW_SCOPE_ATTR_ACCOUNT, OneTimeTokenAccount.class);\n    }\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) {\n        try {\n            val currentAcct = getCandidateAccountFrom(requestContext);\n            val deviceRegistrationEnabled = MultifactorAuthenticationWebflowUtils.isMultifactorDeviceRegistrationEnabled(requestContext);\n            if (!deviceRegistrationEnabled) {\n                LOGGER.warn(\"Device registration is disabled for [{}]\", currentAcct.getUsername());\n                return getErrorEvent(requestContext);\n            }\n\n            if (!isMultipleDeviceRegistrationEnabled(requestContext)\n                && repository.count(currentAcct.getUsername()) > 0) {\n                LOGGER.warn(\"Unable to register multiple devices for [{}]\", currentAcct.getUsername());\n                return getErrorEvent(requestContext);\n            }\n            val account = (T) buildOneTimeTokenAccount(requestContext);\n            if (!validate(account, requestContext)) {\n                LOGGER.error(\"Unable to validate account [{}]\", account);\n                return getErrorEvent(requestContext);\n            }\n\n            val validate = requestContext.getRequestParameters().getBoolean(REQUEST_PARAMETER_VALIDATE);\n            if (validate == null || !validate) {\n                LOGGER.trace(\"Storing account [{}]\", account);\n                MultifactorAuthenticationWebflowUtils.putOneTimeTokenAccount(requestContext, repository.save(account));","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-otp-mfa-core/src/main/java/org/apereo/cas/otp/web/flow/OneTimeTokenAccountSaveRegistrationAction.java#L55-L91","documentation":"This is a warning logged by OneTimeTokenAccountSaveRegistrationAction.doExecuteInternal when a user attempts to save a new OTP device account while device registration is disabled in the MFA webflow configuration. The action short-circuits and returns the error event instead of registering the device. It is thrown when MultifactorAuthenticationWebflowUtils.isMultifactorDeviceRegistrationEnabled evaluates to false for the current request context.","triggerScenarios":"A user hits the OTP registration flow (OneTimeTokenAccountSaveRegistrationAction.execute) while the cas.authn.mfa.core... device-registration-enabled (mfa device registration feature) is disabled in configuration.","commonSituations":"Deployments that pre-provision devices out-of-band but leave the registration webflow reachable; environment-specific config where registration was disabled for production but users still navigate to the registration URL; stale SSO session landing users in the registration flow after an operator disabled registration.","solutions":["Enable device registration in configuration (set cas.authn.mfa.device-registration-enabled=true or the equivalent feature toggle) if self-registration should be allowed.","If registration should stay disabled, remove/hide the registration link and navigation to the OTP registration flow so users do not reach this action.","Verify the request context/screen overrides (per-service or per-tenant MFA settings) are not unintentionally disabling registration for this user."],"exampleFix":"// before: cas.properties\ncas.authn.mfa.device-registration-enabled=false\n// after\ncas.authn.mfa.device-registration-enabled=true","handlingStrategy":"validation","validationCode":"boolean registrationEnabled = casProperties.getAuthn().getMfa().getDeviceRegistrationEnabled();\nif (!registrationEnabled) { /* hide registration flow before invoking action */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep the registration UI link gated on the same property the action checks.","Audit per-service/per-tenant MFA overrides when disabling registration globally."],"tags":["mfa","otp","device-registration","configuration"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}