{"record":{"id":"4961e9a012324dce","repo":"bitwarden/server","slug":"usershouldbefound","errorCode":null,"errorMessage":"UserShouldBeFound","messagePattern":"UserShouldBeFound","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"critical","filePath":"bitwarden_license/src/Sso/Controllers/AccountController.cs","lineNumber":347,"sourceCode":"                // its own match/no-match split (see SsoAuthnRequiresOrgMembershipException\n                // for the two scenarios that converge here).\n                await HttpContext.SignOutAsync(\n                    AuthenticationSchemes.BitwardenExternalCookieAuthenticationScheme);\n\n                var redirectUrl = SsoRedirectUrlBuilder.BuildLoginRedirectUrl(\n                    _globalSettings.BaseServiceUri.VaultWithHash,\n                    ex.UserEmail,\n                    ex.OrganizationId,\n                    ex.OrganizationDisplayName,\n                    SsoRedirectUrlBuilder.ErrorCodes.OrgMembershipRequired);\n\n                return Redirect(redirectUrl);\n            }\n#nullable restore\n        }\n\n        User resolvedSsoLinkedUser = possibleSsoLinkedUser\n                                              ?? throw new Exception(_i18nService.T(\"UserShouldBeFound\"));\n\n        await PreventOrgUserLoginIfStatusInvalidAsync(organization, provider, orgUser, resolvedSsoLinkedUser);\n\n        // This allows us to collect any additional claims or properties\n        // for the specific protocols used and store them in the local auth cookie.\n        // this is typically used to store data needed for signout from those protocols.\n        var additionalLocalClaims = new List<Claim>();\n        var localSignInProps = new AuthenticationProperties\n        {\n            IsPersistent = true,\n            ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(1)\n        };\n        ProcessLoginCallback(result, additionalLocalClaims, localSignInProps);\n\n        // Issue authentication cookie for user\n        await HttpContext.SignInAsync(\n            new IdentityServerUser(resolvedSsoLinkedUser.Id.ToString())\n            {","sourceCodeStart":329,"sourceCodeEnd":365,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Controllers/AccountController.cs#L329-L365","documentation":"Thrown in AccountController.ExternalCallback (line 347) as a null-coalescing throw: possibleSsoLinkedUser is null after both FindUserFromExternalProviderAsync and CreateUserAndOrgUserConditionallyAsync have run. This is an internal invariant violation — the provisioning path is expected to always produce a non-null user.","triggerScenarios":"After the full provisioning flow, the resolved user reference is still null. This should not happen under normal operation; it indicates a logic gap where neither the existing-user path nor the new-user creation path returned a user.","commonSituations":"A code change in CreateUserAndOrgUserConditionallyAsync introduced a path that returns without setting resolvedUser; an exception in the provisioning path was swallowed; a race condition deleted the user between provisioning and assignment.","solutions":["This is an internal server error — investigate server logs around the SSO callback to find the upstream provisioning failure.","Check CreateUserAndOrgUserConditionallyAsync for any code path that could return without a non-null user.","Verify the user provisioning dependencies (user repository, register command) are healthy."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await ExternalCallback(); }\ncatch (Exception ex) when (ex.Message.Contains(\"UserShouldBeFound\"))\n{\n    _logger.LogCritical(ex, \"SSO provisioning invariant violated — no user resolved\");\n    return StatusCode(500, \"An internal error occurred during SSO login.\");\n}","preventionTips":["This is a server-side bug — audit CreateUserAndOrgUserConditionallyAsync for code paths that return without a user.","Add integration tests covering all provisioning scenarios to catch regressions.","Monitor for this error in production; any occurrence indicates a logic defect."],"tags":["sso","authentication","internal","invariant","user-provisioning"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}