passbolt/passbolt_api · error · RecordNotFoundException

$errorMessage

Error message

$errorMessage

What it means

Generic accessor getSetting() throws RecordNotFoundException when a requested Duo setting key is absent from the loaded organization settings array. Messages are supplied by getDuoClientId/getDuoClientSecret/getDuoApiHostname.

Solutions

1. Check provider is enabled/configured (MfaOrgSettings::get()->isProviderEnabled(PROVIDER_DUO)) before reading Duo accessors.
2. Re-save complete Duo settings via POST /mfa/policies/duo.json.
3. Inspect the mfa org settings record in the database for the duo key.
4. Ensure the service is constructed with MfaOrgSettings::get()->getSettings() for the correct organization.

Example fix

// before
$hostname = $duoService->getDuoApiHostname();
// after
if (!MfaOrgSettings::get()->isProviderEnabled(MfaSettings::PROVIDER_DUO)) {
    throw new BadRequestException('Duo provider is not configured.');
}
$hostname = $duoService->getDuoApiHostname();

if (!MfaOrgSettings::get()->isProviderEnabled(MfaSettings::PROVIDER_DUO)) {
    throw new BadRequestException('Duo provider not configured.');
}

try {
    $clientId = $duoService->getDuoClientId();
} catch (RecordNotFoundException $e) {
    // treat as provider-not-configured
    return null;
}

When it happens

Trigger: Calling getDuoClientId(), getDuoClientSecret(), or getDuoApiHostname() on a MfaOrgSettingsDuoService built from settings that do not contain the duo provider entry or the specific key.

Common situations: Duo provider never configured; settings JSON saved under a different provider key; accessing Duo accessors when org settings only contain totp; partially written settings after a failed save.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• Could not enable Duo MFA provider.
• Could not enable Duo MFA provider.
• Could not login using Duo MFA provider.
• Could not validate Duo configuration
• A Duo state cookie is required.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/0c105862e04aa0f8. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Service/MfaOrgSettings/MfaOrgSettingsDuoService.php:156

        if (count($errors) !== 0) {
            $msg = __('Could not validate Duo configuration');
            throw new CustomValidationException($msg, $errors);
        }
    }

    /**
     * Get Duo provider setting.
     *
     * @param string $settingKey organization settings key
     * @param string $errorMessage error message if organization settings key is not found
     * @return string
     * @throws \Cake\Datasource\Exception\RecordNotFoundException if setting is missing
     */
    private function getSetting(string $settingKey, string $errorMessage): string
    {
        if (!isset($this->settings[MfaSettings::PROVIDER_DUO][$settingKey])) {
            throw new RecordNotFoundException($errorMessage);
        }

        return $this->settings[MfaSettings::PROVIDER_DUO][$settingKey];
    }
}

View on GitHub (pinned to 31c1bbc10f)