{"record":{"id":"ed52b4544af861af","repo":"phacility/phabricator","slug":"duo-enrollment-mode-s-is-not-supported","errorCode":null,"errorMessage":"Duo enrollment mode (\"%s\") is not supported.","messagePattern":"Duo enrollment mode \\(\"(.+?)\"\\) is not supported\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/auth/factor/PhabricatorDuoAuthFactor.php","lineNumber":788,"sourceCode":"      default:\n        throw new Exception(\n          pht(\n            'Duo username pairing mode (\"%s\") is not supported.',\n            $mode));\n    }\n  }\n\n  private function shouldAllowDuoEnrollment(\n    PhabricatorAuthFactorProvider $provider) {\n\n    $mode = $provider->getAuthFactorProviderProperty(self::PROP_ENROLL);\n    switch ($mode) {\n      case 'deny':\n        return false;\n      case 'allow':\n        return true;\n      default:\n        throw new Exception(\n          pht(\n            'Duo enrollment mode (\"%s\") is not supported.',\n            $mode));\n    }\n  }\n\n  private function newDuoConfig(PhabricatorUser $user, $duo_user) {\n    $config_properties = array(\n      'duo.username' => $duo_user,\n    );\n\n    $config = $this->newConfigForUser($user)\n      ->setFactorName(pht('Duo (%s)', $duo_user))\n      ->setProperties($config_properties);\n\n    return $config;\n  }\n","sourceCodeStart":770,"sourceCodeEnd":806,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/factor/PhabricatorDuoAuthFactor.php#L770-L806","documentation":"PhabricatorDuoAuthFactor::shouldAllowDuoEnrollment() switches on the provider property 'duo.enroll'; only 'deny' (require existing Duo account) and 'allow' (create new Duo account) are supported, matching the provider edit form's options. Any other value throws when the factor decides whether a user may enroll.","triggerScenarios":"The duo.enroll provider property holds anything except 'deny'/'allow' — direct DB edits, imported/migrated provider rows, or a custom extension writing a foreign value. Thrown during the add-factor (enrollment) flow.","commonSituations":"Restoring a database from a modified fork; scripting provider properties instead of the edit UI; partial upgrades where stored values drift from code.","solutions":["Edit the Duo provider in the UI and re-save the 'Create Accounts' select (Require Existing Duo Account or Create New Duo Account).","Inspect the provider properties and reset duo.enroll to 'deny' or 'allow'.","Recreate the provider if the record is otherwise corrupted (users re-enroll)."],"exampleFix":"// before: hand-edited provider property\n\"duo.enroll\": \"invite\"\n// after: one of the two supported values\n\"duo.enroll\": \"allow\"","handlingStrategy":"validation","validationCode":"// Run when saving the provider config.\n$mode = $provider->getAuthFactorProviderProperty(\n  PhabricatorDuoAuthFactor::PROP_ENROLL);\nif (!in_array($mode, array('deny', 'allow'), true)) {\n  // reject the save; only deny/allow are implemented\n}","typeGuard":"function isSupportedDuoEnrollMode($mode) {\n  return in_array($mode, array('deny', 'allow'), true);\n}","tryCatchPattern":null,"preventionTips":["Only use the edit form's select options for duo.enroll.","Do not import provider rows from forks with extra modes.","Smoke-test enrollment after restoring or migrating auth tables."],"tags":["duo","provider-config","phabricator","config-value"],"backgroundTag":"invalid-config-value","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}