{"record":{"id":"ff27fb7778ada7bc","repo":"apereo/cas","slug":"unable-to-register-multiple-devices-for","errorCode":null,"errorMessage":"Unable to register multiple devices for [{}]","messagePattern":"Unable to register multiple devices for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-otp-mfa-core/src/main/java/org/apereo/cas/otp/web/flow/OneTimeTokenAccountSaveRegistrationAction.java","lineNumber":79,"sourceCode":"\n    protected T getCandidateAccountFrom(final RequestContext requestContext) {\n        return (T) requestContext.getFlowScope()\n            .get(OneTimeTokenAccountCreateRegistrationAction.FLOW_SCOPE_ATTR_ACCOUNT, OneTimeTokenAccount.class);\n    }\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) {\n        try {\n            val currentAcct = getCandidateAccountFrom(requestContext);\n            val deviceRegistrationEnabled = MultifactorAuthenticationWebflowUtils.isMultifactorDeviceRegistrationEnabled(requestContext);\n            if (!deviceRegistrationEnabled) {\n                LOGGER.warn(\"Device registration is disabled for [{}]\", currentAcct.getUsername());\n                return getErrorEvent(requestContext);\n            }\n\n            if (!isMultipleDeviceRegistrationEnabled(requestContext)\n                && repository.count(currentAcct.getUsername()) > 0) {\n                LOGGER.warn(\"Unable to register multiple devices for [{}]\", currentAcct.getUsername());\n                return getErrorEvent(requestContext);\n            }\n            val account = (T) buildOneTimeTokenAccount(requestContext);\n            if (!validate(account, requestContext)) {\n                LOGGER.error(\"Unable to validate account [{}]\", account);\n                return getErrorEvent(requestContext);\n            }\n\n            val validate = requestContext.getRequestParameters().getBoolean(REQUEST_PARAMETER_VALIDATE);\n            if (validate == null || !validate) {\n                LOGGER.trace(\"Storing account [{}]\", account);\n                MultifactorAuthenticationWebflowUtils.putOneTimeTokenAccount(requestContext, repository.save(account));\n            }\n            return success();\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        }\n        return getErrorEvent(requestContext);","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-otp-mfa-core/src/main/java/org/apereo/cas/otp/web/flow/OneTimeTokenAccountSaveRegistrationAction.java#L61-L97","documentation":"This warning is logged by OneTimeTokenAccountSaveRegistrationAction.doExecuteInternal when multiple-device registration is disabled (isMultipleDeviceRegistrationEnabled returns false) and the user already has at least one registered OTP device (repository.count(username) > 0). The action returns the error event rather than registering a second device.","triggerScenarios":"User with an existing registered OTP device submits the device registration action again while multiple device registration is disabled in the OTP MFA configuration.","commonSituations":"Users re-visiting the registration screen after already enrolling a device; test accounts reused across enrollment attempts; deployments that expect multi-device support but never enabled the multi-device setting.","solutions":["Enable multiple device registration (cas.authn.mfa.trusted-device... / otp multiple-device-registration-enabled=true in the OTP MFA properties) if users should enroll more than one device.","Direct the user to manage/delete their existing device before enrolling a new one, instead of registering again.","Clear the user's existing registered device(s) from the OTP account repository if re-enrollment should be allowed under single-device policy."],"exampleFix":"// before: cas.properties\ncas.authn.mfa.otp.multiple-device-registration-enabled=false\n// after\ncas.authn.mfa.otp.multiple-device-registration-enabled=true","handlingStrategy":"validation","validationCode":"boolean multiAllowed = casProperties.getAuthn().getMfa().getOtp().isMultipleDeviceRegistrationEnabled();\nboolean hasDevices = otpAccountRepository.count(username) > 0;\nif (hasDevices && !multiAllowed) { /* redirect user to device management instead */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Show the registration screen only when the user has zero devices under single-device policy.","Provide a device-management screen to delete old devices before re-enrollment."],"tags":["mfa","otp","device-registration","configuration"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}