### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [July 2, 2024, 4:13pm UTC](https://meta.discourse.org/t/run-second-factor-failing-when-trying-to-promote-admin/314516/8 "2024-07-02T16:13:18Z")
Sigh. It looks like the error in `run_second_factor!` was from my debugging statements; causing bugs when looking for them is one of my favorite pastimes.
```plaintext
Started PUT "/admin/users/30591/grant_admin" for 174.50.213.142 at 2024-07-02 14:14:38 +0000
Processing by Admin::UsersController#grant_admin as */*
Parameters: {"user_id"=>"30591"}
Completed 403 Forbidden in 6ms (Views: 0.1ms | ActiveRecord: 0.0ms | Allocations: 2263)
```
I guess that the guardian is not allowing me to make the user an admin for some reason.
But I still don’t understand why it’s failing and why it’s got `An unhandled server error has occurred.` as the error, when I can’t find that error anywhere in the Discourse code.
Ah. And this is interesting. I have been able to change from `jay@example.com` to `myaddress@gmail.com`, but trying to confirm an address of `myaddress+123@gmail.com` is also getting “An unhandled server error has occurred.” message. `normalize_emails` is not set.
I think that something is wrong with `run_second_factor!`, but I can’t quite figure out what. I’m adding some `Rails.logger.warn` with some `xxx.inspect`s, so maybe I’ll find something.
Best I can figure something is wrong with the `auth_manager`. It seems like maybe it’s trying to redirect for some reason? Normal users aren’t required to have 2fa, so I don’t know why a regular user wouldn’t be able to change their email address. But I’ve tried with a user with no 2fa, backup codes, logged in before clicking the confirm new email link and after logged in and all fail with “An unhandled server error has occurred.”
This seems related:
> [@](#):
>
> After this method is called, the auth manager will send a 403 response with a
> JSON body. It does that by raising an exception that’s then rescued by a
> `rescue_from` handler. The JSON response contains a challenge nonce which the
> client/frontend will need to complete the 2fa. More on this later.
>
---
### Author:  [@Osama](https://meta.discourse.org/u/Osama)
#### Post date: [July 2, 2024, 8:18pm UTC](https://meta.discourse.org/t/run-second-factor-failing-when-trying-to-promote-admin/314516/9 "2024-07-02T20:18:05Z")
> [@pfaffman](#):
>
> `Completed 403 Forbidden in 6ms (Views: 0.1ms | ActiveRecord: 0.0ms | Allocations: 2263)`
The 403 error is normal and expected — the frontend app catches the 403 response and interprets it as “can’t grant admin because 2FA is required, let’s navigate to the 2FA page”.
What is not normal is:
> [@pfaffman](#):
>
> it’s got `An unhandled server error has occurred.`
Can you tell me where you’re seeing this error? Is it a popup in the frontend? Error in logs? As you mention, I cannot find this error message anywhere in the entire history of the codebase, so it’s very weird.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [July 2, 2024, 8:30pm UTC](https://meta.discourse.org/t/run-second-factor-failing-when-trying-to-promote-admin/314516/10 "2024-07-02T20:30:45Z")
> [@Osama](#):
>
> The 403 error is normal and expected — the frontend app catches the 403 response and interprets it as “can’t grant admin because 2FA is required, let’s navigate to the 2FA page”.
So maybe the back end isn’t rendering the stuff that has the 2FA URL in it? But the error happens regardless of whether the user has 2fa turned on and regardless of whether the force-2fa sitesetting is enabled. And regardless of whether the user is logged in with 2fa already set.
> [@Osama](#):
>
> Is it a popup in the frontend
> [@Osama](#):
>
> so it’s very weird.
Right. I’ve tried safe-mode, but these are the plugins:
```plaintext
- git clone https://github.com/discourse/docker_manager.git
- git clone https://github.com/discourse/discourse-topic-voting.git
- git clone https://github.com/discourse/discourse-chat-integration.git
- git clone https://github.com/discourse/discourse-solved.git
- git clone https://github.com/discourse/discourse-reactions.git
- git clone https://github.com/discourse/discourse-docs.git
- git clone https://github.com/discourse/discourse-user-notes.git
```
The only clue that I’ve found is that it implies that the message is coming from Rails itself. Still, I’ve been unable to catch how that could be happening.
So maybe something is at play that’s triggering “we need 2fa” when, in fact, 2fa isn’t needed. It certainly makes sense that an error would get triggered to do 2fa login when none exists. I guess that’s in `guardian`? I can’t figure out where to put debugging `Rails.logger` stuff to debug that.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [July 2, 2024, 11:11pm UTC](https://meta.discourse.org/t/run-second-factor-failing-when-trying-to-promote-admin/314516/11 "2024-07-02T23:11:00Z")
This is a very long shot so my apologies when I am saying something totally ridiculous… but googling for " `An unhandled server error has occurred`" refers _only_ to [Bitwarden](https://github.com/bitwarden/server/blob/4c77f993e561ca37265b9b7caf3b9cc85e69504b/src/Api/Utilities/ExceptionHandlerFilterAttribute.cs#L117) code which leads me to believe that there might be something on your local system that is intercepting / messing with your request. Is this something you can reproduce from another computer?
---
### Author:  [@Osama](https://meta.discourse.org/u/Osama)
#### Post date: [July 3, 2024, 2:03am UTC](https://meta.discourse.org/t/run-second-factor-failing-when-trying-to-promote-admin/314516/13 "2024-07-03T02:03:52Z")
> [@pfaffman](#):
>
> 
Can you check the networks tab in the dev tools of your browser and see what the response looks like for the request to the `grant_admin` endpoint?
Please also show the Payload tab.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [July 3, 2024, 1:56pm UTC](https://meta.discourse.org/t/run-second-factor-failing-when-trying-to-promote-admin/314516/14 "2024-07-03T13:56:25Z")
This seems to be coming from the server. I can’t find that string in the database (say in customized text) or grepping all of /var/www/discourse
There is no Payload tab:
**Wait!!!** I restored the database to another server and it properly redirects to the second factor page, which, after getting the second factor key, immediately changes the user’s admin status (no email required! which I didn’t know!).
So it’s something with . . . something, but a clean mostly-[standard install](https://meta.discourse.org/t/142537?silent=true) resolves the problem. In any case, not (obviously?) a :discourse: 🐛 . I changed the category.
The other potential explanation, which also seems far-fetched, is that there is something somehow wrong with the `UserSecondFactor` model, as I did a `UserSecondFactor.all.destroy_all;UserSecurityKey.all.destroy_all;` on my test server since it had a different domain name. I also used Google authenticator instead of my Yubi key.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [August 2, 2024, 1:56pm UTC](https://meta.discourse.org/t/run-second-factor-failing-when-trying-to-promote-admin/314516/15 "2024-08-02T13:56:51Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.