passbolt/passbolt_api · error · RecordNotFoundException

MFA verification date is not set for this provider.

Error message

MFA verification date is not set for this provider.

What it means

getVerifiedFrozenTime() returns the DateTime at which a given provider was verified for the account. It throws RecordNotFoundException when settings[provider][VERIFIED] is absent — the provider exists (or not) but no verification timestamp was recorded for it.

Solutions

1. Verify the provider is both enabled and verified before querying: check isset($settings[$provider]['verified']) via an accessor or the verify() flow first.
2. Catch RecordNotFoundException and treat the provider as unverified.
3. Have the user complete the MFA verification flow for that provider so the verified timestamp is stored.
4. Confirm the provider name string matches the enabled provider exactly (totp, yubikey, duo).

Example fix

// before
$verifiedAt = $mfaAccountSettings->getVerifiedFrozenTime('totp');
// after
try {
    $verifiedAt = $mfaAccountSettings->getVerifiedFrozenTime('totp');
} catch (\Cake\Datasource\Exception\RecordNotFoundException $e) {
    $verifiedAt = null; // provider not verified
}

$verifiedAt = null;
try { $verifiedAt = $s->getVerifiedFrozenTime($provider); } catch (RecordNotFoundException $e) {}

try { $dt = $s->getVerifiedFrozenTime($p); } catch (\Cake\Datasource\Exception\RecordNotFoundException $e) { $dt = null; } // treat as unverified

When it happens

Trigger: Calling getVerifiedFrozenTime($provider) with a provider that has no 'verified' entry in the account settings — e.g. provider configured but never successfully verified, or provider key entirely missing from settings.

Common situations: Checking verification expiry for a provider the user enabled but never completed verification for; race between enabling a provider and verifying it; asking about a provider the user never set up; querying org-disabled providers against stale account settings.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• $errorMessage
• MFA setting OTP provisioning uri is not set.
• MFA setting Yubikey Id is not set.
• No MFA provider set.
• Unable to verify Duo authentication.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/74ee78206a3e74a6. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaAccountSettings.php:175

        foreach ($providers as $provider) {
            if ($this->isProviderReady($provider)) {
                $result[] = $provider;
            }
        }

        return $result;
    }

    /**
     * Return verification date time as FrozenTime
     *
     * @param string $provider name of the provider
     * @return \Cake\I18n\DateTime
     */
    public function getVerifiedFrozenTime(string $provider): DateTime
    {
        if (!isset($this->settings[$provider][self::VERIFIED])) {
            throw new RecordNotFoundException(__('MFA verification date is not set for this provider.'));
        }

        return new DateTime($this->settings[$provider][MfaAccountSettings::VERIFIED]);
    }

    /**
     * Enable a new mfa provider for the given user
     *
     * @param \App\Utility\UserAccessControl $uac access control
     * @param string $provider name of the provider
     * @param array|null $data data
     * @return void
     */
    public static function enableProvider(UserAccessControl $uac, string $provider, ?array $data = []): void
    {
        $data['verified'] = DateTime::now();
        try {
            /** @var \Passbolt\AccountSettings\Model\Table\AccountSettingsTable $AccountSettings */

View on GitHub (pinned to 31c1bbc10f)