{"record":{"id":"dbc5aaa31d90026c","repo":"passbolt/passbolt_api","slug":"no-valid-multi-factor-authentication-settings-found-for-this","errorCode":null,"errorMessage":"No valid multi-factor authentication settings found for this provider.","messagePattern":"No valid multi-factor authentication settings found for this provider\\.","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaVerifyController.php","lineNumber":108,"sourceCode":"     * will continue to execute past a disabled provider and can mint an MFA cookie.\n     *\n     * @param string $provider name of the provider\n     * @return \\Cake\\Http\\Response|null redirect response for non-JSON requests, null when settings are valid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException on JSON requests with invalid settings\n     */\n    protected function _handleInvalidSettings(string $provider): ?Response\n    {\n        if ($this->mfaSettings->getAccountSettings() === null) {\n            if ($this->getRequest()->is('json')) {\n                throw new BadRequestException(__('No valid multi-factor authentication settings found.'));\n            } else {\n                return $this->redirect('/');\n            }\n        }\n        if (!$this->mfaSettings->isProviderEnabled($provider)) {\n            // for example a user is trying to force a check on a provider that is not set for the org\n            if ($this->getRequest()->is('json')) {\n                throw new BadRequestException(\n                    __('No valid multi-factor authentication settings found for this provider.')\n                );\n            } else {\n                return $this->redirect('/');\n            }\n        }\n\n        return null;\n    }\n\n    /**\n     * Generate MFA verification token and cookie and decorate response accordingly\n     *\n     * @param string $provider name of the provider\n     * @param \\App\\Authenticator\\SessionIdentificationServiceInterface $sessionIdentificationService session ID service\n     * @param \\Passbolt\\MultiFactorAuthentication\\Service\\MfaPolicies\\RememberAMonthSettingInterface $rememberMeForAMonthSetting Remember a month setting.\n     * @return void\n     */","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaVerifyController.php#L90-L126","documentation":"A variant of the invalid-settings error: the user may have MFA account settings, but the requested provider is not enabled/available for them or the organization. JSON verify requests for that provider fail with a BadRequestException; browser clients are redirected to '/'.","triggerScenarios":"JSON GET/POST to /mfa/verify/<provider> where mfaSettings->isProviderEnabled($provider) is false — e.g. forcing a provider check that the organization never enabled for the user.","commonSituations":"User set up totp but the client requests duo verification; admin changed the enabled providers list after the user's client cached it; URL-forcing a disabled provider.","solutions":["Verify with a provider the user actually has enabled","Enable the requested provider in organization MFA settings","Refresh the client's MFA settings cache/state"],"exampleFix":"// before\nawait http.post('/mfa/verify/duo.json', {...}); // duo not enabled\n// after\nawait http.post('/mfa/verify/totp.json', {totp});","handlingStrategy":"validation","validationCode":"const settings = await getAccountMfaSettings();\nif (!settings?.providers?.includes(provider)) throw new Error(`Provider ${provider} not enabled for user`);","typeGuard":null,"tryCatchPattern":"try { await mfaVerify(provider); } catch (e) { if (/for this provider/.test(e.message)) offerEnabledProviders(); else throw e; }","preventionTips":["Only offer providers present in the user's settings","Refresh org provider list when admins change it","Never construct verify URLs from unvalidated provider input"],"tags":["mfa","verify","provider-not-enabled","http-400"],"backgroundTag":"feature-not-enabled","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T09:17:21.228Z"}