{"record":{"id":"648e95c266ce4a3c","repo":"apereo/cas","slug":"list-of-candidate-multifactor-authentication-provi","errorCode":null,"errorMessage":"List of candidate multifactor authentication providers is empty","messagePattern":"List of candidate multifactor authentication providers is empty","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-webflow-mfa-api/src/main/java/org/apereo/cas/web/flow/authentication/RankedMultifactorAuthenticationProviderSelector.java","lineNumber":30,"sourceCode":"\n/**\n * This is {@link RankedMultifactorAuthenticationProviderSelector}\n * that sorts providers based on their rank and picks the one with\n * the highest priority.\n *\n * @author Misagh Moayyed\n * @since 5.0.0\n */\n@Slf4j\npublic class RankedMultifactorAuthenticationProviderSelector implements MultifactorAuthenticationProviderSelector {\n\n    @Override\n    public MultifactorAuthenticationProvider resolve(final Collection<MultifactorAuthenticationProvider> providers,\n                                                     @Nullable final RegisteredService service,\n                                                     final Principal principal) {\n        val sorted = new ArrayList<>(providers);\n        if (sorted.isEmpty()) {\n            throw new IllegalArgumentException(\"List of candidate multifactor authentication providers is empty\");\n        }\n        AnnotationAwareOrderComparator.sort(sorted);\n        return selectMultifactorAuthenticationProvider(service, sorted);\n    }\n\n    protected MultifactorAuthenticationProvider selectMultifactorAuthenticationProvider(\n        @Nullable final RegisteredService service,\n        final List<MultifactorAuthenticationProvider> providers) {\n        val provider = providers.getLast();\n        LOGGER.debug(\"Selected the provider [{}] for service [{}] out of [{}] providers\", provider, service, providers.size());\n        return provider;\n    }\n}\n","sourceCodeStart":12,"sourceCodeEnd":44,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-webflow-mfa-api/src/main/java/org/apereo/cas/web/flow/authentication/RankedMultifactorAuthenticationProviderSelector.java#L12-L44","documentation":"RankedMultifactorAuthenticationProviderSelector.resolve sorts and selects the highest-ranked MFA provider, and refuses to run with an empty candidate list, throwing IllegalArgumentException. An empty provider list means no MultifactorAuthenticationProvider matched the request, so ranking is meaningless.","triggerScenarios":"Calling resolve(providers, service, principal) with an empty Collection of providers — e.g. when the registered service's multifactor policy yields no active providers (no providers configured/enabled, or all filtered out by service MFA policy).","commonSituations":"cas.authn.mfa provider not configured/enabled in the environment while a service's MFA policy requests MFA; custom code invoking the selector directly with an unfiltered/empty collection; provider beans missing from the Spring context.","solutions":["Configure at least one MFA provider (e.g. cas.authn.mfa.gauth) and confirm its bean is present in the application context","Guard the call: only invoke resolve when the provider collection is non-empty","Check the registered service's multifactor policy for typos in provider ids","Review provider filtering (GlobalAuthenticationPolicyAdaptorRanker / provider activation) so matching providers are not excluded"],"exampleFix":"// before\nvar provider = rankedSelector.resolve(providers, service, principal);\n// after\nif (providers == null || providers.isEmpty()) {\n    return; // skip MFA selection, continue with base authentication\n}\nvar provider = rankedSelector.resolve(providers, service, principal);","handlingStrategy":"validation","validationCode":"Collection<MultifactorAuthenticationProvider> providers = ...;\nif (providers == null || providers.isEmpty()) {\n    throw new IllegalStateException(\"Configure an MFA provider (cas.authn.mfa.*) before selecting\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return selector.resolve(providers, service, principal);\n} catch (IllegalArgumentException e) {\n    logger.warn(\"No MFA providers configured; skipping MFA\");\n    return null;\n}","preventionTips":["Configure and enable at least one MFA provider bean","Verify registered service MFA policy ids match configured provider ids","Sanity-check provider filtering when resolving candidates before selection"],"tags":["mfa","configuration","empty-collection"],"backgroundTag":"empty-result-set","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}