{"record":{"id":"ee69db545b5fd299","repo":"passbolt/passbolt_api","slug":"it-is-not-possible-to-create-an-authentication-token-for","errorCode":null,"errorMessage":"It is not possible to create an authentication token for this user.","messagePattern":"It is not possible to create an authentication token for this user\\.","errorType":"validation","errorClass":"ValidationException","httpStatus":400,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaVerifiedToken.php","lineNumber":73,"sourceCode":"            'data' => json_encode([\n                'provider' => $provider,\n                'user_agent' => env('HTTP_USER_AGENT'),\n                'remember' => $remember,\n            ]),\n        ];\n        $accessibleFields = [\n            'user_id' => true,\n            'token' => true,\n            'active' => true,\n            'type' => true,\n            'data' => true,\n        ];\n        $token = $AuthenticationTokens->newEntity($entityData, ['accessibleFields' => $accessibleFields]);\n        $token->hashAndSetSessionId($sessionId);\n        $msg = __('It is not possible to create an authentication token for this user.');\n        $errors = $token->getErrors();\n        if (!empty($errors) || !$AuthenticationTokens->save($token)) {\n            throw new ValidationException($msg);\n        }\n\n        return $token->token;\n    }\n\n    /**\n     * Check if a mfa verified token is legit.\n     *\n     * Production call paths MUST supply $rememberMeForAMonthSetting so a row claiming\n     * remember-me can be re-validated against the live policy. If the policy disables\n     * remember-me, the token is invalidated outright (hard logout) — see PB-29515.\n     * When the parameter is null, legacy behaviour is preserved for the benefit of\n     * test/internal callers without the policy in scope.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac user access control\n     * @param string $tokenString token\n     * @param \\App\\Authenticator\\SessionIdentificationServiceInterface|null $sessionIdentificationService Session ID identifier, required unless logging in\n     * @param \\Cake\\Http\\ServerRequest|null $request Server request, required only if $sessionIdentificationService is required","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaVerifiedToken.php#L55-L91","documentation":"Thrown by MfaVerifiedToken::get when creating the MFA verified authentication token fails entity validation or persistence. The AuthenticationToken entity (type mfa) could not be saved, so the MFA flow is aborted.","triggerScenarios":"Creating an MFA verified token via _handlePostSuccess, Duo MFA cookie creation, etc., when the new AuthenticationToken entity has validation errors (e.g. missing user id, invalid fields) or the save fails at the database.","commonSituations":"Database connection issues, a corrupted/duplicated authentication token record, or custom plugins altering the AuthenticationTokens table schema/validation rules so the mfa token entity fails to save.","solutions":["Inspect the logs for the underlying save/validation error on authentication_tokens.","Verify the user id passed in the UAC is valid and the user exists.","Check the authentication_tokens table schema matches migrations (bin/cake migrate).","Retry the MFA verification flow; if persistent, check for custom validation rules on AuthenticationTokensTable."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (empty($uac->getId())) { throw new \\InvalidArgumentException('Valid user required before creating MFA token'); }","typeGuard":null,"tryCatchPattern":"try { $token = MfaVerifiedToken::get($uac, $sessionId); } catch (ValidationException $e) { // inspect token entity errors and db health }","preventionTips":["Ensure migrations keep authentication_tokens schema current.","Validate the user id exists before creating MFA tokens.","Watch database error logs for save failures."],"tags":["mfa","authentication-token","validation"],"backgroundTag":"database-write-failed","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}