theonedev/onedev · info · ExplicitException

Two-factor authentication not enabled

Error message

Two-factor authentication not enabled

What it means

MyTwoFactorAuthenticationPage throws an ExplicitException when the current user is not subject to enforced two-factor authentication. The page manages 2FA settings and only applies when 2FA is mandatory for the user. Thrown as a localized, user-facing message.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/my/twofactorauthentication/MyTwoFactorAuthenticationPage.java:22

import io.onedev.server.model.User;
import io.onedev.server.web.component.user.twofactorauthentication.TwoFactorAuthenticationStatusPanel;
import io.onedev.server.web.page.my.MyPage;

import static io.onedev.server.model.User.Type.ORDINARY;
import static io.onedev.server.web.translation.Translation._T;

import org.apache.wicket.Component;
import org.apache.wicket.markup.html.basic.Label;
import org.apache.wicket.request.mapper.parameter.PageParameters;

public class MyTwoFactorAuthenticationPage extends MyPage {

	public MyTwoFactorAuthenticationPage(PageParameters params) {
		super(params);
		if (getUser().getType() != ORDINARY || getUser().isDisabled())
			throw new IllegalStateException();
		else if (!getUser().isEnforce2FA())
			throw new ExplicitException(_T("Two-factor authentication not enabled"));		
	}
	
	@Override
	protected void onInitialize() {
		super.onInitialize();

		add(new TwoFactorAuthenticationStatusPanel("content") {
			@Override
			protected User getUser() {
				return MyTwoFactorAuthenticationPage.this.getUser();
			}
		});
	}

	@Override
	protected Component newTopbarTitle(String componentId) {
		return new Label(componentId, _T("Two Factor Authentication"));
	}

View on GitHub (pinned to d44925c47c)

Solutions

1. Enable two-factor authentication enforcement for the user (via group or system security setting) if 2FA enrollment is desired
2. Have an admin configure the 2FA requirement in server settings
3. Use the general profile security page if non-enforced 2FA enrollment is available

if (user.getType() == ORDINARY && !user.isEnforce2FA()) {
    // 2FA page not applicable; hide or route elsewhere
}

try {
    openTwoFactorPage();
} catch (ExplicitException e) {
    showNotEnrolledAvailableInfo();
}

When it happens

Trigger: Opening the my two-factor-authentication page as a user for whom getUser().isEnforce2FA() is false (e.g. not in a group/project requiring 2FA).

Common situations: Users on instances without the 2FA enforcement setting enabled, or accounts not covered by the 2FA-enforcing group, trying to self-enroll.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication required
• This api can only be accessed via cluster credential
• Not authenticated
• Invalid or expired access token
• Account is disabled

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/acccb4cfec974efc. Report an issue: GitHub.