{"record":{"id":"6191700089fb2b09","repo":"apereo/cas","slug":"not-all-requested-multifactor-providers-could-be-f","errorCode":null,"errorMessage":"Not all requested multifactor providers could be found. Requested providers are [<globalProviderIds>] and resolved providers are [<providerIds>]","messagePattern":"Not all requested multifactor providers could be found\\. Requested providers are \\[<globalProviderIds>\\] and resolved providers are \\[<providerIds>\\]","errorType":"exception","errorClass":"MultifactorAuthenticationProviderAbsentException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-mfa-api/src/main/java/org/apereo/cas/authentication/mfa/trigger/GlobalMultifactorAuthenticationTrigger.java","lineNumber":118,"sourceCode":"                return StringUtils.commaDelimitedListToSet(globalProviderId);\n            })\n            .filter(providers -> !providers.isEmpty())\n            .orElseGet(() -> {\n                val globalProviderId = casProperties.getAuthn().getMfa().getTriggers().getGlobal().getGlobalProviderId();\n                return StringUtils.commaDelimitedListToSet(globalProviderId);\n            });\n    }\n\n    protected void handleAbsentMultifactorProvider(final Set<String> globalProviderIds,\n                                                   final List<MultifactorAuthenticationProvider> resolvedProviders) {\n        val providerIds = resolvedProviders\n            .stream()\n            .map(MultifactorAuthenticationProvider::getId)\n            .collect(Collectors.joining(\",\"));\n        val message = String.format(\"Not all requested multifactor providers could be found. \"\n            + \"Requested providers are [%s] and resolved providers are [%s]\", globalProviderIds, providerIds);\n        LOGGER.warn(message, globalProviderIds);\n        throw new MultifactorAuthenticationProviderAbsentException(message);\n    }\n\n    protected Optional<MultifactorAuthenticationProvider> resolveSingleMultifactorProvider(\n        final MultifactorAuthenticationProvider resolvedProvider) {\n        LOGGER.debug(\"Resolved single multifactor provider [{}]\", resolvedProvider);\n        return Optional.of(resolvedProvider);\n    }\n\n    protected Optional<MultifactorAuthenticationProvider> resolveMultifactorProvider(\n        final Authentication authentication,\n        final RegisteredService registeredService,\n        final List<MultifactorAuthenticationProvider> resolvedProviders) throws Throwable {\n        val principal = authentication.getPrincipal();\n        val provider = multifactorAuthenticationProviderSelector.resolve(resolvedProviders, registeredService, principal);\n        LOGGER.debug(\"Selected multifactor authentication provider for this transaction is [{}]\", provider);\n        return Optional.ofNullable(provider);\n    }\n}","sourceCodeStart":100,"sourceCodeEnd":136,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-mfa-api/src/main/java/org/apereo/cas/authentication/mfa/trigger/GlobalMultifactorAuthenticationTrigger.java#L100-L136","documentation":"GlobalMultifactorAuthenticationTrigger compares the globally requested MFA provider ids (cas.authn.mfa.global-provider-id, or from the principal attributes) against the providers actually resolved/registered in the CAS context. If any requested id has no matching MultifactorAuthenticationProvider bean, handleAbsentMultifactorProvider logs a warning and throws MultifactorAuthenticationProviderAbsentException, treating MFA as unsatisfiable.","triggerScenarios":"isActivated (or shouldMultifactorAuthenticatorsBeActivated) runs while cas.authn.mfa.global-provider-id (or the request/principal-supplied provider ids) references an id such as 'mfa-duo' for which no provider module/bean is registered.","commonSituations":"Setting global-provider-id but forgetting to include the corresponding provider dependency (e.g. cas-server-support-otp-mfa) and its configuration; typo in provider id (ids are like 'mfa-gauth', 'mfa-duo', 'mfa-simple'); provider bean filtered out by disabled feature conditions; copying config from another environment where the module is enabled.","solutions":["Add/enable the CAS module that provides the missing provider (e.g. cas-server-support-gauth, duo, otp-mfa) so its auto-configuration registers the bean.","Correct cas.authn.mfa.global-provider-id (and any principal-attribute provider ids) to match a registered provider id; check resolved ids in the WARN log.","Verify the provider's feature/condition is enabled in cas.features (module present but inactive).","If MFA should be optional, remove the global provider id instead of referencing a nonexistent provider."],"exampleFix":"// before\ncas.authn.mfa.global-provider-id=mfa-duo   // duo module not on classpath\n// after: add dependency + matching config, or use an enabled provider\nimplementation \"org.apereo.cas:cas-server-support-duo\"\ncas.authn.mfa.duo[0].registry-name=...","handlingStrategy":"validation","validationCode":"val ids = casProperties.getAuthn().getMfa().getGlobalProviderId()\nval available = providers.map { it.getId() }.toSet()\nif (ids != null && !available.containsAll(Arrays.asList(ids.split(\",\")))) {\n  throw new IllegalStateException(\"Unresolved MFA provider ids configured\");\n}","typeGuard":null,"tryCatchPattern":"try { return trigger.isActivated(principal, service, request, context); }\ncatch (MultifactorAuthenticationProviderAbsentException e) {\n  LOGGER.error(\"MFA provider missing\", e);\n  return Optional.empty();\n}","preventionTips":["Add the support module for every referenced mfa-* provider id","Validate global-provider-id values against resolved ids at startup","Avoid hand-typing provider ids; copy them from documentation/log output"],"tags":["mfa","configuration","provider"],"backgroundTag":"missing-required-config","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}