passbolt/passbolt_api · error · InternalErrorException

Could not login using Duo MFA provider.

Error message

Could not login using Duo MFA provider.

What it means

MfaDuoLoginService's constructor builds the Duo SDK client via MfaDuoGetSdkClientService::getOrFail() using the org settings and the mfa_verify token type. If client construction or retrieval fails for any reason (missing/misconfigured Duo org settings, network errors, invalid token type), it wraps the failure into a generic InternalErrorException so callers get one stable message for login-time Duo failures.

Solutions

1. Check MFA organization settings: ensure Duo is enabled and client id, client secret, host, and integration key are correctly configured
2. Run the MFA Duo healthcheck / verify network connectivity from the server to Duo (duosecurity.com endpoints)
3. Inspect the previous exception chained in InternalErrorException to see the root cause (settings parse error vs network)
4. If config is correct but Duo is down, retry later or disable the Duo provider temporarily

Example fix

// before (org settings incomplete)
// 'multiFactorAuthentication' => ['providers' => ['duo']] // no duo settings block
// after
// 'multiFactorAuthentication' => ['providers' => ['duo'], 'duo' => ['clientId' => '...', 'clientSecret' => '...', 'host' => 'api-....duosecurity.com']]

$settings = MfaOrgSettingsDuoService::retrieveOrganizationSettings(); // ensure duo settings exist and provider is enabled before constructing the login service

try { $service = new MfaDuoLoginService(); } catch (InternalErrorException $e) { $root = $e->getPrevious(); log($root); return 503; }

When it happens

Trigger: Instantiating MfaDuoLoginService (typically during a Duo MFA login request) when the Duo organization settings are absent/invalid, the Duo SDK client cannot be created, or getOrFail() throws for any reason.

Common situations: Admins enabled MFA provider Duo but never filled in client id/secret/host; org settings JSON corrupted after migration; misconfigured or expired Duo API credentials; Duo outage making the initial client setup fail.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• Could not enable Duo MFA provider.
• Could not enable Duo MFA provider.
• An authentication token state is required.
• Could not create MFA verified cookie.
• Could not validate Duo configuration

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/bdda519c475443f7. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Service/Duo/MfaDuoLoginService.php:58

    protected Client $duoClient;

    /**
     * MfaDuoLoginService constructor.
     *
     * @param \Duo\DuoUniversal\Client|null $client Duo SDK Client
     * @return void
     * @throws \Cake\Http\Exception\InternalErrorException If it cannot create the Duo Sdk Client
     */
    public function __construct(?Client $client = null)
    {
        try {
            $this->duoClient = $client ?? (new MfaDuoGetSdkClientService())->getOrFail(
                new MfaOrgSettingsDuoService(MfaOrgSettings::get()->getSettings()),
                AuthenticationToken::TYPE_MFA_VERIFY
            );
        } catch (Throwable $th) {
            $msg = __('Could not login using Duo MFA provider.');
            throw new InternalErrorException($msg, null, $th);
        }
    }

    /**
     * Login using Duo for the operator.
     *
     * @param \App\Utility\UserAccessControl $uac The user access control
     * @param \Passbolt\MultiFactorAuthentication\Model\Dto\MfaDuoCallbackDto $duoCallbackDto The Duo callback data
     * @param string $token The authentication token.
     * @return \App\Model\Entity\AuthenticationToken
     * @throws \InvalidArgumentException if the provided token is not a UUID
     * @throws \Cake\Http\Exception\UnauthorizedException If no active Duo callback authentication can be found.
     * @throws \Cake\Http\Exception\UnauthorizedException If the duo state cannot be verified.
     * @throws \Cake\Http\Exception\UnauthorizedException If the Duo code cannot be verified.
     */
    public function login(
        UserAccessControl $uac,
        MfaDuoCallbackDto $duoCallbackDto,

View on GitHub (pinned to 31c1bbc10f)