{"record":{"id":"dc73a2e8344fba7b","repo":"ory/kratos","slug":"requested-unknown-aal-s","errorCode":null,"errorMessage":"requested unknown aal: %s","messagePattern":"requested unknown aal: (.+?)","errorType":"validation","errorClass":"errors.Errorf","httpStatus":null,"severity":"error","filePath":"session/manager_http.go","lineNumber":435,"sourceCode":"\t\tcase identity.AuthenticatorAssuranceLevel1:\n\t\t\t// The identity has AAL1, the session has AAL1, we're good.\n\t\t\treturn nil\n\t\tcase identity.AuthenticatorAssuranceLevel2:\n\t\t\t// The identity has AAL2, the session has AAL1, we need to upgrade the session.\n\n\t\t\t// Since we ended up here, it also means that `sess.Identity.InternalAvailableAAL` was `aal1` and is now `aal2`.\n\t\t\t// Let's update the database.\n\t\t\tif managerOpts.upsertAAL {\n\t\t\t\tif err := s.r.PrivilegedIdentityPool().UpdateIdentityColumns(ctx, sess.Identity, \"available_aal\"); err != nil {\n\t\t\t\t\treturn err\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\treturn NewErrAALNotSatisfied(loginURL.String())\n\t}\n\n\treturn errors.Errorf(\"requested unknown aal: %s\", requestedAAL)\n}\n\nfunc (s *ManagerHTTP) SessionAddAuthenticationMethods(ctx context.Context, sid uuid.UUID, ams ...AuthenticationMethod) (err error) {\n\tctx, span := s.r.Tracer(ctx).Tracer().Start(ctx, \"sessions.ManagerHTTP.SessionAddAuthenticationMethods\")\n\tdefer otelx.End(span, &err)\n\n\t// Since we added the method, it also means that we have authenticated it\n\tsess, err := s.r.SessionPersister().GetSession(ctx, sid, ExpandNothing)\n\tif err != nil {\n\t\treturn err\n\t}\n\tfor _, m := range ams {\n\t\tsess.CompletedLoginForMethod(m)\n\t}\n\t// Completing an authentication method is an authentication event, so the\n\t// session's authenticated_at is refreshed as well. This matches login\n\t// flows, which set authenticated_at when a second factor completes.\n\tsess.AuthenticatedAt = time.Now().UTC()","sourceCodeStart":417,"sourceCodeEnd":453,"githubUrl":"https://github.com/ory/kratos/blob/b86338da04a040247a07f46100a86dcfb3875909/session/manager_http.go#L417-L453","documentation":"DoesSessionSatisfy on ManagerHTTP maps a requested AuthenticationMethodLevel (aal1/aal2) to a check against the session. If requestedAAL is anything other than the known levels, the manager cannot evaluate it and returns this error. It indicates a programming/configuration mistake rather than a session state problem.","triggerScenarios":"Calling DoesSessionSatisfy (directly or via session validation middleware) with an AuthenticationMethodLevel value that is not AAL1 or AAL2 — e.g. an empty string, a raw \"aal3\", or a misparsed config value passed as the requested AAL.","commonSituations":"Custom code constructing an AuthenticationMethodLevel from user input or config without validating it, typo like \"aal\" or \"AAL1\" (case-sensitive), or a newer AAL value used against an older library version.","solutions":["Only pass session.AuthenticatorAssuranceLevel1 or AuthenticatorAssuranceLevel2 constants; never raw strings.","Validate any config-driven AAL value before calling (e.g. switch or lookup against known constants).","Check for case-sensitivity/whitespace issues when converting user input to an AAL level.","Upgrade the library if you need a higher AAL than the current version supports."],"exampleFix":"// before\nerr = s.DoesSessionSatisfy(ctx, req, \"aal3\")\n// after\nerr = s.DoesSessionSatisfy(ctx, req, session.AuthenticatorAssuranceLevel2)","handlingStrategy":"validation","validationCode":"func validAAL(l session.AuthenticationMethodLevel) bool {\n  return l == session.AuthenticatorAssuranceLevel1 || l == session.AuthenticatorAssuranceLevel2\n}","typeGuard":"func isKnownAAL(s string) bool {\n  switch s {\n  case \"aal1\", \"aal2\":\n    return true\n  }\n  return false\n}","tryCatchPattern":"if err := s.DoesSessionSatisfy(ctx, req, aal); err != nil {\n  if strings.HasPrefix(err.Error(), \"requested unknown aal\") {\n    return fmt.Errorf(\"invalid aal configured: %q\", aal)\n  }\n  return err\n}","preventionTips":["Always use the exported AuthenticatorAssuranceLevel constants, never raw strings.","Validate config-supplied AAL values at startup.","Trim/lowercase any AAL derived from external input before use."],"tags":["session","aal","invalid-argument","mfa"],"backgroundTag":"invalid-enum-value","analyzedSha":"b86338da04a040247a07f46100a86dcfb3875909","analyzedAt":"2026-09-07T15:58:15.934Z","contentChangedAt":"2026-09-07T15:58:15.934Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}