{"record":{"id":"843d0cebb3158919","repo":"apereo/cas","slug":"passwordless-account-does-not-allow-multifact","errorCode":null,"errorMessage":"Passwordless account [{}] does not allow multifactor authentication","messagePattern":"Passwordless account \\[(.+?)\\] does not allow multifactor authentication","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java","lineNumber":55,"sourceCode":"    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {\n        val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));\n\n        if (!user.isAllowSelectionMenu()) {\n            LOGGER.error(\"Passwordless account [{}] is not allowed to select options\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n\n        val selection = extractSelectedAuthenticationOption(requestContext);\n        if (selection == PasswordlessSelectionMenu.PASSWORD && !doesPasswordlessAccountRequestPassword(user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not require a password\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        if (selection == PasswordlessSelectionMenu.DELEGATION && !isDelegatedAuthenticationActiveFor(requestContext, user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not allow delegated authentication\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        if (selection == PasswordlessSelectionMenu.MFA && !shouldActivateMultifactorAuthenticationFor(requestContext, user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not allow multifactor authentication\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        return buildFinalSelectionEvent(requestContext, selection);\n    }\n\n    protected Event buildFinalSelectionEvent(final RequestContext requestContext, final PasswordlessSelectionMenu selection) {\n        val finalEvent = switch (selection) {\n            case PASSWORD -> {\n                val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));\n                WebUtils.putCasLoginFormViewable(requestContext, doesPasswordlessAccountRequestPassword(user));\n                yield CasWebflowConstants.TRANSITION_ID_PROMPT;\n            }\n            case TOKEN -> CasWebflowConstants.TRANSITION_ID_DISPLAY;\n            case MFA -> CasWebflowConstants.TRANSITION_ID_MFA;\n            case DELEGATION -> CasWebflowConstants.TRANSITION_ID_DELEGATED_AUTHENTICATION_REDIRECT;\n        };\n\n        return eventFactory.event(this, finalEvent);","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java#L37-L73","documentation":"AcceptPasswordlessSelectionMenuAction rejects the MFA menu option when shouldActivateMultifactorAuthenticationFor is false; CAS logs this warning and returns an error event. Multifactor authentication is not available/triggered for this passwordless account in the current request.","triggerScenarios":"User selects MFA in the passwordless selection menu while no MFA provider is eligible (provider not configured, trigger conditions unmet, or account not enrolled) for the requestContext.","commonSituations":"MFA module not enabled or provider misconfigured; MFA trigger (e.g. global/provider trigger) does not activate for this principal; user selects a stale menu option; service excluded from MFA.","solutions":["Verify the MFA provider is configured and enabled (cas.authn.mfa.*)","Check MFA trigger conditions resolve true for this user/service","Confirm the passwordless account's allowed options include MFA","Have the user choose another option or reload the selection menu"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"if (selection == PasswordlessSelectionMenu.MFA && !mfaTriggers.evaluate(principal, service)) renderMenuAgain(account);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Confirm MFA providers are configured and enabled","Keep MFA trigger conditions aligned with the passwordless menu","Remove stale menu options on page reload"],"tags":["passwordless","webflow","mfa"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}