passbolt/passbolt_api · error · BadRequestException

No valid multi-factor authentication settings found.

Error message

No valid multi-factor authentication settings found.

What it means

Thrown when the user has no MFA account settings at all (getAccountSettings() returns null) but sends a JSON verify request. Since there is nothing configured to verify against, JSON clients get a BadRequestException while browser clients are redirected to '/'.

Solutions

1. Complete MFA setup for the user (/mfa/setup/<provider>) before verifying
2. Confirm the user actually has MFA account settings stored in the database
3. Re-create the account settings if they were lost (org requirement permitting)

Example fix

// before
await http.post('/mfa/verify/totp.json', {totp}); // no settings
// after: setup first
await http.post('/mfa/setup/totp.json', {otpProvisioningUri, totp});

const settings = await getAccountMfaSettings();
if (settings == null) redirectToSetup();

try { await mfaVerify(provider); } catch (e) { if (/No valid multi-factor authentication settings/.test(e.message)) redirectToMfaSetup(); else throw e; }

When it happens

Trigger: JSON GET/POST to /mfa/verify/<provider> for a user who never completed MFA setup for any provider.

Common situations: User removed/disabled their MFA settings but the client still attempts verification; fresh account where MFA was required by policy but setup never ran; stale frontend state after admin reset.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No valid multi-factor authentication settings found for…
• The multi-factor authentication is not required.
• This authentication provider is already setup. Disable it…
• This authentication provider is not enabled for your…
• This functionality is not available using AJAX/JSON.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/f68277b2a0756be6. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaVerifyController.php:100

            }
        }
    }

    /**
     * Trigger an error if current MFA settings do not allow verify for the given provider.
     *
     * Callers MUST return the response when a non-null value is returned; otherwise the request
     * will continue to execute past a disabled provider and can mint an MFA cookie.
     *
     * @param string $provider name of the provider
     * @return \Cake\Http\Response|null redirect response for non-JSON requests, null when settings are valid
     * @throws \Cake\Http\Exception\BadRequestException on JSON requests with invalid settings
     */
    protected function _handleInvalidSettings(string $provider): ?Response
    {
        if ($this->mfaSettings->getAccountSettings() === null) {
            if ($this->getRequest()->is('json')) {
                throw new BadRequestException(__('No valid multi-factor authentication settings found.'));
            } else {
                return $this->redirect('/');
            }
        }
        if (!$this->mfaSettings->isProviderEnabled($provider)) {
            // for example a user is trying to force a check on a provider that is not set for the org
            if ($this->getRequest()->is('json')) {
                throw new BadRequestException(
                    __('No valid multi-factor authentication settings found for this provider.')
                );
            } else {
                return $this->redirect('/');
            }
        }

        return null;
    }

View on GitHub (pinned to 31c1bbc10f)