theonedev/onedev · error · ExplicitException

Two-factor authentication not enabled

Error message

Two-factor authentication not enabled

What it means

UserTwoFactorAuthenticationPage manages a user's 2FA configuration and is only meaningful when 2FA enforcement is on. In onInitialize it checks getUser().isEnforce2FA() and throws this ExplicitException if the user does not have two-factor authentication enforced, since there is nothing to configure or display.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/user/twofactorauthentication/UserTwoFactorAuthenticationPage.java:25

import static io.onedev.server.model.User.Type.ORDINARY;

import org.apache.wicket.request.mapper.parameter.PageParameters;

public class UserTwoFactorAuthenticationPage extends UserPage {

	public UserTwoFactorAuthenticationPage(PageParameters params) {
		super(params);
		if (getUser().getType() != ORDINARY || getUser().isDisabled())
			throw new IllegalStateException();
	}
	
	@Override
	protected void onInitialize() {
		super.onInitialize();

		if (!getUser().isEnforce2FA())
			throw new ExplicitException("Two-factor authentication not enabled");

		add(new TwoFactorAuthenticationStatusPanel("content") {
			@Override
			protected User getUser() {
				return UserTwoFactorAuthenticationPage.this.getUser();
			}
		});
	}

}

View on GitHub (pinned to d44925c47c)

Solutions

1. Enable two-factor authentication enforcement for the user (Admin > Users > user > enable 2FA / enforce 2FA) before opening the page.
2. If 2FA was intentionally disabled, remove the bookmark/link to this page — it is not applicable.
3. Check the server-level 2FA policy; if policy changed recently, update user flags accordingly.

Example fix

// before: direct navigation
GET /~admin/users/john/two-factor-authentication

// after: enable enforcement first
Admin -> Users -> john -> Two-factor authentication -> Enable

// Only link/open the 2FA page when enforcement is on
if (user.isEnforce2FA()) {
    // safe to navigate to UserTwoFactorAuthenticationPage
}

When it happens

Trigger: Opening the two-factor authentication page (direct URL or menu link) for a user whose enforce2FA flag is false.

Common situations: An administrator bookmarks the 2FA page; server-wide 2FA enforcement was turned off but the link remains in a saved bookmark; navigating to another user's 2FA settings who is not covered by the enforcement policy.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication required
• Access denied
• This api can only be accessed via cluster credential
• Invalid report name
• Invalid report name

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/12d79fdd235ed27d. Report an issue: GitHub.