passbolt/passbolt_api · error · BadRequestException

This authentication provider is not enabled for your…

Error message

This authentication provider is not enabled for your organization.

What it means

Thrown when the requested MFA provider is not enabled in the organization's MFA settings. MfaController::_orgAllowProviderOrFail checks mfaSettings->getOrganizationSettings()->isProviderEnabled($provider) and rejects the request with a BadRequestException if the provider is absent from the org allow-list.

Solutions

1. Enable the provider in MFA organization settings (admin UI or /app/settings/mfa)
2. Have the user verify with a provider that is enabled
3. Check mfa org settings config/JSON contains the provider key

Example fix

// org settings JSON: only totp enabled
// before: GET /mfa/verify/duo.json
// after: enable duo in org settings, or use
await http.get('/mfa/verify/totp.json');

const enabled = orgSettings?.mfa?.providers ?? [];
if (!enabled.includes(provider)) throw new Error(`Provider ${provider} not enabled for org`);

try { await mfaVerify(provider); } catch (e) { if (/not enabled for your organization/.test(e.message)) redirectToProviderSelection(); else throw e; }

When it happens

Trigger: GET/POST to an MFA verify or setup endpoint for a provider (totp, duo, yubico) that the organization administrator has not enabled in MFA org settings.

Common situations: Admin enabled MFA but only selected totp while the client attempts duo; org settings lost after a migration or config reset; user forcing a provider via URL manipulation.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• No valid multi-factor authentication settings found for…
• Could not enable Duo MFA provider.
• Could not enable Duo MFA provider.
• Could not login using Duo MFA provider.
• Could not save the settings.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/af4ca66f5b63ddd8. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/MultiFactorAuthentication/src/Controller/MfaController.php:60

        // Do not initialize if user is guest and login redirection is scheduled
        if ($this->User->role() !== Role::GUEST) {
            $this->mfaSettings = MfaSettings::get($this->User->getAccessControl());
        }
    }

    /**
     * Fail is organization do not allow this authentication provider
     *
     * @param string $provider name of the provider
     * @throws \Cake\Http\Exception\BadRequestException
     * @return void
     */
    protected function _orgAllowProviderOrFail(string $provider)
    {
        if (!$this->mfaSettings->getOrganizationSettings()->isProviderEnabled($provider)) {
            $msg = __('This authentication provider is not enabled for your organization.');
            throw new BadRequestException($msg);
        }
    }

    /**
     * Clear any dubious cookie if mfa check is required
     *
     * @return void
     */
    protected function _invalidateMfaCookie(): void
    {
        (new ClearMfaCookieInResponseService($this))->clearMfaCookie();
    }

    /**
     * Assert the request is not of json type.
     *
     * @return void
     * @throw BadRequestException if the request is of json type.

View on GitHub (pinned to 31c1bbc10f)