passbolt/passbolt_api · error · RecordNotFoundException

No configuration set for Yubikey OTP clientId.

Error message

No configuration set for Yubikey OTP clientId.

What it means

getYubikeyOTPClientId() (MfaOrgSettingsYubikeyTrait) returns the organization-level Yubikey API client ID. It throws RecordNotFoundException when org settings have no yubikey.clientId entry, meaning the Yubikey org configuration lacks the credentials needed for the YubiCo OTP verification service.

Solutions

1. Set the org Yubikey clientId via admin MFA org settings (or passbolt.php / YUBICO_OTP_CLIENT_ID env) and save the settings.
2. Catch RecordNotFoundException and skip/ disable Yubikey verification with a clear message when org credentials are absent.
3. Verify both clientId and secretKey are saved together when configuring org Yubikey.
4. Check the stored OrganizationSettings payload includes yubikey.clientId after any settings migration.

Example fix

// before
$clientId = $mfaOrgSettings->getYubikeyOTPClientId();
// after
try {
    $clientId = $mfaOrgSettings->getYubikeyOTPClientId();
} catch (\Cake\Datasource\Exception\RecordNotFoundException $e) {
    throw new InternalErrorException('Yubikey org settings are incomplete.');
}

$configured = isset($orgSettings->toArray()['yubikey'][MfaOrgSettings::YUBIKEY_CLIENT_ID]);

try { $id = $orgSettings->getYubikeyOTPClientId(); } catch (\Cake\Datasource\Exception\RecordNotFoundException $e) { /* disable yubikey provider or error out */ }

When it happens

Trigger: Calling getYubikeyOTPClientId() when org settings lack MfaOrgSettings::YUBIKEY_CLIENT_ID under the yubikey provider — org Yubikey never configured, partially saved, or clientId dropped during settings update.

Common situations: Yubikey login verification failing on instances where only the secretKey was configured but not the clientId; config not carried over after migration/redeployment; admin saved settings with clientId left blank; tests missing yubikey org fixtures.

Related errors

• No configuration set for Yubikey OTP secret key.
• Could not validate Yubikey configuration.
• Invalid MFA org settings.
• MFA setting Yubikey Id is not set.
• This is not a valid Ajax/Json request.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/4ec73db30ef0da19. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php:49

    public function getYubikeyOTPSecretKey(): string
    {
        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY])) {
            throw new RecordNotFoundException(__('No configuration set for Yubikey OTP secret key.'));
        }

        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY];
    }

    /**
     * getYubikeyOTPClientId
     *
     * @throw RecordNotFoundException if config is missing
     * @return string
     */
    public function getYubikeyOTPClientId(): string
    {
        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID])) {
            throw new RecordNotFoundException(__('No configuration set for Yubikey OTP clientId.'));
        }

        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID];
    }

    /**
     * validateYubikeySettings
     *
     * @throw CustomValidationException if there is an issue
     * @param array $data user provider data
     * @return void
     */
    public function validateYubikeySettings(array $data): void
    {
        $errors = [];

        if (!isset($data[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID])) {
            $msg = __('No configuration set for Yubikey OTP clientId.');

View on GitHub (pinned to 31c1bbc10f)