{"record":{"id":"1afea7a1f7187a50","repo":"bitwarden/server","slug":"samlart-parameter-detected-saml-artifact-binding","errorCode":null,"errorMessage":"SAMLart parameter detected. SAML Artifact binding is not allowed.","messagePattern":"SAMLart parameter detected\\. SAML Artifact binding is not allowed\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Utilities/SsoAuthenticationMiddleware.cs","lineNumber":25,"sourceCode":"\npublic class SsoAuthenticationMiddleware\n{\n    private readonly RequestDelegate _next;\n\n    public SsoAuthenticationMiddleware(RequestDelegate next, IAuthenticationSchemeProvider schemes)\n    {\n        _next = next ?? throw new ArgumentNullException(nameof(next));\n        Schemes = schemes ?? throw new ArgumentNullException(nameof(schemes));\n    }\n\n    public IAuthenticationSchemeProvider Schemes { get; set; }\n\n    public async Task Invoke(HttpContext context)\n    {\n        if ((context.Request.Method == \"GET\" && context.Request.Query.ContainsKey(\"SAMLart\"))\n            || (context.Request.Method == \"POST\" && context.Request.Form.ContainsKey(\"SAMLart\")))\n        {\n            throw new Exception(\"SAMLart parameter detected. SAML Artifact binding is not allowed.\");\n        }\n\n        context.Features.Set<IAuthenticationFeature>(new AuthenticationFeature\n        {\n            OriginalPath = context.Request.Path,\n            OriginalPathBase = context.Request.PathBase\n        });\n\n        // Give any IAuthenticationRequestHandler schemes a chance to handle the request\n        var handlers = context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();\n        foreach (var scheme in await Schemes.GetRequestHandlerSchemesAsync())\n        {\n            // Determine if scheme is appropriate for the current context FIRST\n            if (scheme is IDynamicAuthenticationScheme dynamicScheme)\n            {\n                switch (dynamicScheme.SsoType)\n                {\n                    case SsoType.OpenIdConnect:","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Utilities/SsoAuthenticationMiddleware.cs#L7-L43","documentation":"Thrown by SsoAuthenticationMiddleware when an incoming HTTP request contains a 'SAMLart' query parameter (GET) or form field (POST). SAML Artifact binding is an alternative SAML binding that redirects through an artifact resolution service; Bitwarden explicitly rejects it for security and complexity reasons, allowing only POST and Redirect bindings.","triggerScenarios":"An identity provider (IdP) is configured to use SAML Artifact binding, causing it to send a SAMLart parameter in the assertion response. The middleware detects this before any authentication handler runs and throws immediately.","commonSituations":"The IdP's SAML binding settings were changed to Artifact (often labeled 'HTTP-Artifact' in IdP admin consoles like ADFS, OneLogin, or Azure AD). A new IdP integration defaults to Artifact binding. An IdP falls back to Artifact when POST binding fails.","solutions":["Reconfigure the identity provider to use HTTP-POST or HTTP-Redirect binding for SAML responses instead of HTTP-Artifact.","In ADFS: edit the Relying Party Trust and set the binding to 'POST'. In Azure AD/Entra: check the SAML response binding setting in the enterprise application.","Verify the IdP's metadata to confirm the AssertionConsumerService binding matches urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST.","If Artifact binding is a hard requirement, this is a product limitation — file a feature request, as the middleware unconditionally blocks it."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Client-side: detect and warn about Artifact binding before submitting\nif (samlResponseUrl.includes('SAMLart=')) {\n    alert('Your identity provider is using SAML Artifact binding, which is not supported. Please contact your IdP administrator to switch to POST or Redirect binding.');\n    return;\n}","typeGuard":null,"tryCatchPattern":"// Global exception handler in Startup/Program\napp.UseExceptionHandler(ex => ex.Run(async context =>\n{\n    if (context.Features.Get<IExceptionHandlerPathFeature>()?.Error is Exception ex\n        && ex.Message.Contains(\"SAMLart\"))\n    {\n        context.Response.StatusCode = 400;\n        await context.Response.WriteAsync(\"SAML Artifact binding is not supported. Configure your IdP to use POST or Redirect binding.\");\n    }\n}));","preventionTips":["During SSO setup, explicitly verify the IdP's binding setting is HTTP-POST or HTTP-Redirect.","Document in the SSO setup guide that Artifact binding is unsupported.","Monitor for this error in production logs to proactively reach out to affected org admins."],"tags":["sso","saml","security","middleware","bitwarden-license"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}