passbolt/passbolt_api · error · ValidationException

It is not possible to create an authentication token for…

Error message

It is not possible to create an authentication token for this user.

What it means

Thrown by MfaVerifiedToken::get when creating the MFA verified authentication token fails entity validation or persistence. The AuthenticationToken entity (type mfa) could not be saved, so the MFA flow is aborted.

Solutions

Inspect the logs for the underlying save/validation error on authentication_tokens.
Verify the user id passed in the UAC is valid and the user exists.
Check the authentication_tokens table schema matches migrations (bin/cake migrate).
Retry the MFA verification flow; if persistent, check for custom validation rules on AuthenticationTokensTable.

Defensive patterns

Strategy: try-catch

Validate before calling

if (empty($uac->getId())) { throw new \InvalidArgumentException('Valid user required before creating MFA token'); }

Try / catch

try { $token = MfaVerifiedToken::get($uac, $sessionId); } catch (ValidationException $e) { // inspect token entity errors and db health }

Prevention

Ensure migrations keep authentication_tokens schema current.
Validate the user id exists before creating MFA tokens.
Watch database error logs for save failures.

When it happens

Trigger: Creating an MFA verified token via _handlePostSuccess, Duo MFA cookie creation, etc., when the new AuthenticationToken entity has validation errors (e.g. missing user id, invalid fields) or the save fails at the database.

Common situations: Database connection issues, a corrupted/duplicated authentication token record, or custom plugins altering the AuthenticationTokens table schema/validation rules so the mfa token entity fails to save.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/ee69db545b5fd299. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaVerifiedToken.php:73

            'data' => json_encode([
                'provider' => $provider,
                'user_agent' => env('HTTP_USER_AGENT'),
                'remember' => $remember,
            ]),
        ];
        $accessibleFields = [
            'user_id' => true,
            'token' => true,
            'active' => true,
            'type' => true,
            'data' => true,
        ];
        $token = $AuthenticationTokens->newEntity($entityData, ['accessibleFields' => $accessibleFields]);
        $token->hashAndSetSessionId($sessionId);
        $msg = __('It is not possible to create an authentication token for this user.');
        $errors = $token->getErrors();
        if (!empty($errors) || !$AuthenticationTokens->save($token)) {
            throw new ValidationException($msg);
        }

        return $token->token;
    }

    /**
     * Check if a mfa verified token is legit.
     *
     * Production call paths MUST supply $rememberMeForAMonthSetting so a row claiming
     * remember-me can be re-validated against the live policy. If the policy disables
     * remember-me, the token is invalidated outright (hard logout) — see PB-29515.
     * When the parameter is null, legacy behaviour is preserved for the benefit of
     * test/internal callers without the policy in scope.
     *
     * @param \App\Utility\UserAccessControl $uac user access control
     * @param string $tokenString token
     * @param \App\Authenticator\SessionIdentificationServiceInterface|null $sessionIdentificationService Session ID identifier, required unless logging in
     * @param \Cake\Http\ServerRequest|null $request Server request, required only if $sessionIdentificationService is required

View on GitHub (pinned to 31c1bbc10f)