passbolt/passbolt_api · error · InternalErrorException

Could not generate TOTP secret, please try again later.

Error message

Could not generate TOTP secret, please try again later.

What it means

Wraps a TypeError thrown while generating a random TOTP secret into an InternalErrorException. The TypeError comes from random_bytes receiving an invalid secret length (e.g. non-integer or negative) derived from the MFA config.

Solutions

1. Inspect the MFA TOTP configuration value used for secret length and set it to a valid positive integer.
2. Clear the config cache (bin/cake cache clear_all) after fixing the config file.
3. Check for plugins or custom code overriding MfaOtpFactory::getAndSanitizeSecretLengthFromConfig.
4. Retry TOTP setup once config is fixed; if persistent, check the PHP version behavior of random_bytes.

Example fix

// before (config/mfa.php)
'totp' => ['secretLength' => 'five'],
// after
'totp' => ['secretLength' => 32],

if (!is_int($secretLength) || $secretLength <= 0) { throw new \InvalidArgumentException('secretLength must be a positive int'); }

function isValidSecretLength($v): bool { return is_int($v) && $v > 0; }

try { $secret = MfaOtpFactory::generateTOTP($uac); } catch (InternalErrorException $e) { // inspect TOTP secretLength config }

When it happens

Trigger: Calling MfaOtpFactory::generateTOTP when the configured TOTP secret length resolves to an invalid value, causing random_bytes($secretLength) to raise TypeError (PHP 8 throws TypeError for bad lengths).

Common situations: A malformed passbolt.php or config/mfa.php entry like 'secretLength' => '5' (string) or a negative number instead of a positive integer.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Could not generate enough random bytes, please try again…
• MFA setting OTP provisioning uri is not set.
• Something went wrong when validating the one-time password.
• A Duo state cookie is required.
• A Duo state cookie is required.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/5a57445c5c97a04b. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOtpFactory.php:70

        $url = str_replace(':', '', $url);
        $url = rtrim($url, '/');

        return $url;
    }

    /**
     * Generate a random TOTP
     *
     * @param \App\Utility\UserAccessControl $uac user access control
     * @return string provisioning uri
     */
    public static function generateTOTP(UserAccessControl $uac): string
    {
        $secretLength = self::getAndSanitizeSecretLengthFromConfig();
        try {
            $secret = trim(Base32::encode(random_bytes($secretLength)), '='); // some random bytes Base32 without padding
        } catch (TypeError $exception) {
            throw new InternalErrorException(
                'Could not generate TOTP secret, please try again later.',
                500,
                $exception
            );
        } catch (Exception $exception) {
            throw new InternalErrorException(
                'Could not generate enough random bytes, please try again later.',
                500,
                $exception
            );
        }

        $totp = TOTP::create($secret);
        $totp->setLabel($uac->getUsername()); // label: string shown below the code digits
        $totp->setIssuer(self::getIssuer()); // issuer: string shown above the code digits

        return $totp->getProvisioningUri();
    }

View on GitHub (pinned to 31c1bbc10f)