Bug: 'Multiple Controls with the Same ID' Error at MFA When a Device Is Registered Twice Under the Same Name – SecureAuth Support

Version Affected: 24.04 before 24.4.7.12, 26.0, and 26.1
Bug Number: EE-3955
Bug Status: Closed - Fixed
Fixed in Version(s): 24.4.7.12 and later, and 26.2 and later

Overview

Multi-factor authentication (MFA) into a realm fails with a Multiple controls with the same ID error when the same device is registered for a user twice under the same name: once for a FIDO (Fast Identity Online) method and once for a non-FIDO MFA method. For example, this happens with a YubiKey registered both ways.

Cause

This is a known defect (EE-3955). With the same device registered under the same name for both a FIDO method and a non-FIDO method, the MFA page builds two entries with the same internal control ID. ASP.NET requires every control on a page to have a unique ID, so the page fails with an error like this:

Multiple controls with the same ID 'ContentPlaceHolder1_MFALoginControl1_RegistrationMethodView_trYubiKey' were found. FindControl requires that controls have unique IDs.

This example is from a YubiKey registered both ways.

Resolution / Workaround

Upgrade to 24.4.7.12 or a later 24.04 build, or to 26.2 or later, to resolve this issue. 26.0 and 26.1 do not include the fix.

Until you can upgrade, make sure that a device registered for both a FIDO method and a non-FIDO method has a different name in each registration. If a user already has both registrations under the same name, remove one of them, then register the device again for that method under a different name.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.