passbolt/passbolt_api · error · BadRequestException

No valid multi-factor authentication settings found for…

Error message

No valid multi-factor authentication settings found for this provider.

What it means

A variant of the invalid-settings error: the user may have MFA account settings, but the requested provider is not enabled/available for them or the organization. JSON verify requests for that provider fail with a BadRequestException; browser clients are redirected to '/'.

Solutions

1. Verify with a provider the user actually has enabled
2. Enable the requested provider in organization MFA settings
3. Refresh the client's MFA settings cache/state

Example fix

// before
await http.post('/mfa/verify/duo.json', {...}); // duo not enabled
// after
await http.post('/mfa/verify/totp.json', {totp});

const settings = await getAccountMfaSettings();
if (!settings?.providers?.includes(provider)) throw new Error(`Provider ${provider} not enabled for user`);

try { await mfaVerify(provider); } catch (e) { if (/for this provider/.test(e.message)) offerEnabledProviders(); else throw e; }

When it happens

Trigger: JSON GET/POST to /mfa/verify/<provider> where mfaSettings->isProviderEnabled($provider) is false — e.g. forcing a provider check that the organization never enabled for the user.

Common situations: User set up totp but the client requests duo verification; admin changed the enabled providers list after the user's client cached it; URL-forcing a disabled provider.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No valid multi-factor authentication settings found.
• The multi-factor authentication is not required.
• This authentication provider is not enabled for your…
• This authentication provider is already setup. Disable it…
• This functionality is not available using AJAX/JSON.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/dbc5aaa31d90026c. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaVerifyController.php:108

     * will continue to execute past a disabled provider and can mint an MFA cookie.
     *
     * @param string $provider name of the provider
     * @return \Cake\Http\Response|null redirect response for non-JSON requests, null when settings are valid
     * @throws \Cake\Http\Exception\BadRequestException on JSON requests with invalid settings
     */
    protected function _handleInvalidSettings(string $provider): ?Response
    {
        if ($this->mfaSettings->getAccountSettings() === null) {
            if ($this->getRequest()->is('json')) {
                throw new BadRequestException(__('No valid multi-factor authentication settings found.'));
            } else {
                return $this->redirect('/');
            }
        }
        if (!$this->mfaSettings->isProviderEnabled($provider)) {
            // for example a user is trying to force a check on a provider that is not set for the org
            if ($this->getRequest()->is('json')) {
                throw new BadRequestException(
                    __('No valid multi-factor authentication settings found for this provider.')
                );
            } else {
                return $this->redirect('/');
            }
        }

        return null;
    }

    /**
     * Generate MFA verification token and cookie and decorate response accordingly
     *
     * @param string $provider name of the provider
     * @param \App\Authenticator\SessionIdentificationServiceInterface $sessionIdentificationService session ID service
     * @param \Passbolt\MultiFactorAuthentication\Service\MfaPolicies\RememberAMonthSettingInterface $rememberMeForAMonthSetting Remember a month setting.
     * @return void
     */

View on GitHub (pinned to 31c1bbc10f)