passbolt/passbolt_api · error · RecordNotFoundException

No configuration set for Yubikey OTP secret key.

Error message

No configuration set for Yubikey OTP secret key.

What it means

getYubikeyOTPSecretKey() (MfaOrgSettingsYubikeyTrait) returns the organization-level Yubikey OTP secret key used to authenticate against the YubiCo API. It throws RecordNotFoundException when org settings have no yubikey.secretKey entry, i.e. the Yubikey org configuration is incomplete.

Solutions

1. Configure the org Yubikey secretKey via admin MFA org settings or config (passbolt.php / YUBICO_OTP_SECRET_KEY env) and save.
2. Check isset(orgSettings yubikey secretKey) or catch RecordNotFoundException before attempting Yubikey verification and disable the provider in that case.
3. Ensure the deployment environment variables for YubiCo are set on the server.
4. If org Yubikey should be disabled, remove yubikey from the org providers list so login flows don't probe its config.

Example fix

// before
$secretKey = $mfaOrgSettings->getYubikeyOTPSecretKey();
// after
try {
    $secretKey = $mfaOrgSettings->getYubikeyOTPSecretKey();
} catch (\Cake\Datasource\Exception\RecordNotFoundException $e) {
    throw new InternalErrorException('Yubikey org settings are incomplete.');
}

$configured = isset($orgSettings->toArray()['yubikey'][MfaOrgSettings::YUBIKEY_SECRET_KEY]);

try { $key = $orgSettings->getYubikeyOTPSecretKey(); } catch (\Cake\Datasource\Exception\RecordNotFoundException $e) { /* disable yubikey provider or error out */ }

When it happens

Trigger: Calling getYubikeyOTPSecretKey() when org settings contain no MfaOrgSettings::YUBIKEY_SECRET_KEY under the yubikey provider — org-level Yubikey never configured or saved without the secretKey field.

Common situations: Users attempting Yubikey MFA login on an instance where the admin never saved the Yubikey org secretKey; secretKey removed after org settings edit; environment-specific config (passbolt.php or env var) missing after redeploy; reading settings in tests without fixtures.

Related errors

• No configuration set for Yubikey OTP clientId.
• Could not validate Yubikey configuration.
• Invalid MFA org settings.
• MFA setting Yubikey Id is not set.
• This is not a valid Ajax/Json request.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/5bf93a56d7dcd267. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Utility/MfaOrgSettingsYubikeyTrait.php:34

 */
namespace Passbolt\MultiFactorAuthentication\Utility;

use App\Error\Exception\CustomValidationException;
use Cake\Datasource\Exception\RecordNotFoundException;
use Cake\Validation\Validation;

trait MfaOrgSettingsYubikeyTrait
{
    /**
     * getYubikeyOTPSecretKey
     *
     * @throw RecordNotFoundException if config is missing
     * @return string
     */
    public function getYubikeyOTPSecretKey(): string
    {
        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY])) {
            throw new RecordNotFoundException(__('No configuration set for Yubikey OTP secret key.'));
        }

        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_SECRET_KEY];
    }

    /**
     * getYubikeyOTPClientId
     *
     * @throw RecordNotFoundException if config is missing
     * @return string
     */
    public function getYubikeyOTPClientId(): string
    {
        if (!isset($this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID])) {
            throw new RecordNotFoundException(__('No configuration set for Yubikey OTP clientId.'));
        }

        return $this->settings[MfaSettings::PROVIDER_YUBIKEY][MfaOrgSettings::YUBIKEY_CLIENT_ID];

View on GitHub (pinned to 31c1bbc10f)