passbolt/passbolt_api · error · BadRequestException

This authentication provider is already setup. Disable it…

Error message

This authentication provider is already setup. Disable it first

What it means

Thrown during MFA provider setup when the user already has a fully configured and ready-to-use account setting for that provider. _notAlreadySetupOrFail refuses to re-run setup for an active provider to prevent overwriting an existing valid configuration.

Solutions

1. Disable the provider first (DELETE /mfa/setup/<provider>) then re-run setup
2. Use the existing provider configuration instead of setting it up again
3. If the stored setting is broken, disable and re-enable the provider

Example fix

// before: POST /mfa/setup/totp.json (fails if already ready)
await http.delete('/mfa/setup/totp.json'); // disable first
await http.post('/mfa/setup/totp.json', data); // then set up

const settings = await getAccountMfaSettings();
if (settings?.providers?.includes(provider)) throw new Error(`Provider ${provider} already set up; disable first`);

try { await mfaSetup(provider); } catch (e) { if (/already setup/.test(e.message)) await disableProvider(provider); }

When it happens

Trigger: GET/POST to /mfa/setup/<provider> when mfaSettings->getAccountSettings()->isProviderReady($provider) returns true (e.g. totp already provisioned with a verified secret).

Common situations: Re-scanning a QR code for totp that is already active; retrying setup after a partially completed flow that actually saved settings; stale client state believing setup is incomplete.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No valid multi-factor authentication settings found.
• No valid multi-factor authentication settings found for…
• The authentication token is not valid.
• The multi-factor authentication is not required.
• The user does not exist, is already active or has been…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/7520595d64a0b328. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaSetupController.php:41

abstract class MfaSetupController extends MfaController
{
    /**
     * Fail is account is already setup for this authentication provider
     *
     * @param string $provider name of the provider
     * @throws \Cake\Http\Exception\BadRequestException
     * @return bool
     */
    protected function _notAlreadySetupOrFail(string $provider)
    {
        if ($this->mfaSettings->getAccountSettings() !== null) {
            $isReadyToUse = $this->mfaSettings
                ->getAccountSettings()
                ->isProviderReady($provider);
            if ($isReadyToUse) {
                $msg = __('This authentication provider is already setup. Disable it first');
                throw new BadRequestException($msg);
            }
        }

        return true;
    }

    /**
     * Handle get request when ready to use settings are present
     *
     * @param string $provider name of the provider
     * @return void
     */
    protected function _handleGetExistingSettings(string $provider)
    {
        $verified = $this->mfaSettings
            ->getAccountSettings()
            ->getVerifiedFrozenTime($provider);
        $this->success(__('Multi Factor Authentication is configured!'), ['verified' => $verified]);

View on GitHub (pinned to 31c1bbc10f)