phacility/phabricator · error · Exception

Duo enrollment mode ("%s") is not supported.

Error message

Duo enrollment mode ("%s") is not supported.

What it means

PhabricatorDuoAuthFactor::shouldAllowDuoEnrollment() switches on the provider property 'duo.enroll'; only 'deny' (require existing Duo account) and 'allow' (create new Duo account) are supported, matching the provider edit form's options. Any other value throws when the factor decides whether a user may enroll.

Source

Thrown at src/applications/auth/factor/PhabricatorDuoAuthFactor.php:788

      default:
        throw new Exception(
          pht(
            'Duo username pairing mode ("%s") is not supported.',
            $mode));
    }
  }

  private function shouldAllowDuoEnrollment(
    PhabricatorAuthFactorProvider $provider) {

    $mode = $provider->getAuthFactorProviderProperty(self::PROP_ENROLL);
    switch ($mode) {
      case 'deny':
        return false;
      case 'allow':
        return true;
      default:
        throw new Exception(
          pht(
            'Duo enrollment mode ("%s") is not supported.',
            $mode));
    }
  }

  private function newDuoConfig(PhabricatorUser $user, $duo_user) {
    $config_properties = array(
      'duo.username' => $duo_user,
    );

    $config = $this->newConfigForUser($user)
      ->setFactorName(pht('Duo (%s)', $duo_user))
      ->setProperties($config_properties);

    return $config;
  }

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Edit the Duo provider in the UI and re-save the 'Create Accounts' select (Require Existing Duo Account or Create New Duo Account).
2. Inspect the provider properties and reset duo.enroll to 'deny' or 'allow'.
3. Recreate the provider if the record is otherwise corrupted (users re-enroll).

Example fix

// before: hand-edited provider property
"duo.enroll": "invite"
// after: one of the two supported values
"duo.enroll": "allow"

// Run when saving the provider config.
$mode = $provider->getAuthFactorProviderProperty(
  PhabricatorDuoAuthFactor::PROP_ENROLL);
if (!in_array($mode, array('deny', 'allow'), true)) {
  // reject the save; only deny/allow are implemented
}

function isSupportedDuoEnrollMode($mode) {
  return in_array($mode, array('deny', 'allow'), true);
}

When it happens

Trigger: The duo.enroll provider property holds anything except 'deny'/'allow' — direct DB edits, imported/migrated provider rows, or a custom extension writing a foreign value. Thrown during the add-factor (enrollment) flow.

Common situations: Restoring a database from a modified fork; scripting provider properties instead of the edit UI; partial upgrades where stored values drift from code.

Related errors

• Duo username pairing mode ("%s") is not supported.
• Unable to load Duo API credential ("%s").
• Duo API hostname ("%s") is invalid, hostname must be "*.duos
• This Duo enrollment attempt is invalid or has expired ("%s")
• Duo API credential ("%s") has no secret key.

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/ed52b4544af861af. Report an issue: GitHub.