passbolt/passbolt_api · error · RecordNotFoundException

MFA setting Yubikey Id is not set.

Error message

MFA setting Yubikey Id is not set.

What it means

getYubikeyId() (MfaAccountSettingsYubikeyTrait) returns the Yubikey ID stored for the account. It throws RecordNotFoundException when settings['yubikey']['id'] is missing, meaning the Yubikey provider was never configured for this user. isYubikeyUserIdSet() relies on it.

Solutions

1. Confirm the user actually enabled the yubikey provider before probing for its id (check enabled providers first).
2. Wrap in try/catch on RecordNotFoundException and treat the Yubikey id as unset.
3. Complete the Yubikey enrollment flow so settings[yubikey][id] gets persisted.
4. Verify the stored account settings JSON contains the 'yubikey' => ['id' => ...] structure.

Example fix

// before
$yubikeyId = $mfaAccountSettings->getYubikeyId();
// after
try {
    $yubikeyId = $mfaAccountSettings->getYubikeyId();
} catch (\Cake\Datasource\Exception\RecordNotFoundException $e) {
    $yubikeyId = null; // no yubikey configured
}

$yubikeyId = null;
try { $yubikeyId = $s->getYubikeyId(); } catch (RecordNotFoundException $e) {}

try { $id = $s->getYubikeyId(); } catch (\Cake\Datasource\Exception\RecordNotFoundException $e) { $id = null; }

When it happens

Trigger: Calling getYubikeyId() or isYubikeyUserIdSet() when the yubikey settings entry has no 'id' key — user never enrolled a Yubikey, or settings saved without the id field.

Common situations: Login-time Yubikey checks for users who enrolled a different provider; account settings payload missing the yubikey.id field after import/migration; tests with incomplete fixture settings; reading settings before the yubikey setup form was submitted.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• Could not validate Yubikey configuration.
• $errorMessage
• MFA setting OTP provisioning uri is not set.
• MFA verification date is not set for this provider.
• No configuration set for Yubikey OTP clientId.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/5f10862f05e00dc4. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaAccountSettingsYubikeyTrait.php:32

 * @link          https://www.passbolt.com Passbolt(tm)
 * @since         2.5.0
 */
namespace Passbolt\MultiFactorAuthentication\Utility;

use Cake\Datasource\Exception\RecordNotFoundException;

trait MfaAccountSettingsYubikeyTrait
{
    /**
     * Return the yubikey id
     *
     * @throws \Cake\Datasource\Exception\RecordNotFoundException if URI is not set
     * @return mixed
     */
    public function getYubikeyId(): mixed
    {
        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][self::YUBIKEY_ID])) {
            throw new RecordNotFoundException(__('MFA setting Yubikey Id is not set.'));
        }

        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][self::YUBIKEY_ID];
    }

    /**
     * Check if YubikeyUserId is set
     *
     * @return bool
     */
    public function isYubikeyUserIdSet(): bool
    {
        try {
            $this->getYubikeyId();
        } catch (RecordNotFoundException $exception) {
            return false;
        }

View on GitHub (pinned to 31c1bbc10f)