{"record":{"id":"af4ca66f5b63ddd8","repo":"passbolt/passbolt_api","slug":"this-authentication-provider-is-not-enabled-for-your","errorCode":null,"errorMessage":"This authentication provider is not enabled for your organization.","messagePattern":"This authentication provider is not enabled for your organization\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaController.php","lineNumber":60,"sourceCode":"\n        // Do not initialize if user is guest and login redirection is scheduled\n        if ($this->User->role() !== Role::GUEST) {\n            $this->mfaSettings = MfaSettings::get($this->User->getAccessControl());\n        }\n    }\n\n    /**\n     * Fail is organization do not allow this authentication provider\n     *\n     * @param string $provider name of the provider\n     * @throws \\Cake\\Http\\Exception\\BadRequestException\n     * @return void\n     */\n    protected function _orgAllowProviderOrFail(string $provider)\n    {\n        if (!$this->mfaSettings->getOrganizationSettings()->isProviderEnabled($provider)) {\n            $msg = __('This authentication provider is not enabled for your organization.');\n            throw new BadRequestException($msg);\n        }\n    }\n\n    /**\n     * Clear any dubious cookie if mfa check is required\n     *\n     * @return void\n     */\n    protected function _invalidateMfaCookie(): void\n    {\n        (new ClearMfaCookieInResponseService($this))->clearMfaCookie();\n    }\n\n    /**\n     * Assert the request is not of json type.\n     *\n     * @return void\n     * @throw BadRequestException if the request is of json type.","sourceCodeStart":42,"sourceCodeEnd":78,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaController.php#L42-L78","documentation":"Thrown when the requested MFA provider is not enabled in the organization's MFA settings. MfaController::_orgAllowProviderOrFail checks mfaSettings->getOrganizationSettings()->isProviderEnabled($provider) and rejects the request with a BadRequestException if the provider is absent from the org allow-list.","triggerScenarios":"GET/POST to an MFA verify or setup endpoint for a provider (totp, duo, yubico) that the organization administrator has not enabled in MFA org settings.","commonSituations":"Admin enabled MFA but only selected totp while the client attempts duo; org settings lost after a migration or config reset; user forcing a provider via URL manipulation.","solutions":["Enable the provider in MFA organization settings (admin UI or /app/settings/mfa)","Have the user verify with a provider that is enabled","Check mfa org settings config/JSON contains the provider key"],"exampleFix":"// org settings JSON: only totp enabled\n// before: GET /mfa/verify/duo.json\n// after: enable duo in org settings, or use\nawait http.get('/mfa/verify/totp.json');","handlingStrategy":"validation","validationCode":"const enabled = orgSettings?.mfa?.providers ?? [];\nif (!enabled.includes(provider)) throw new Error(`Provider ${provider} not enabled for org`);","typeGuard":null,"tryCatchPattern":"try { await mfaVerify(provider); } catch (e) { if (/not enabled for your organization/.test(e.message)) redirectToProviderSelection(); else throw e; }","preventionTips":["Fetch org MFA settings before offering provider choices","Keep admin provider enablement in sync with client feature flags","Check response 400 messages for provider mismatches early"],"tags":["mfa","configuration","provider-not-enabled","http-400"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}