{"record":{"id":"4e8bb1a6af291e7c","repo":"bitwarden/server","slug":"organizationuserunknownstatus","errorCode":null,"errorMessage":"OrganizationUserUnknownStatus","messagePattern":"OrganizationUserUnknownStatus","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Controllers/AccountController.cs","lineNumber":893,"sourceCode":"        OrganizationUserStatusType[] allowedStatuses,\n        string organizationDisplayNameForLogging)\n    {\n        // if this status is one of the allowed ones, just return\n        if (allowedStatuses.Contains(statusToCheckAgainst))\n        {\n            return;\n        }\n\n        // otherwise throw the appropriate exception\n        switch (statusToCheckAgainst)\n        {\n            case OrganizationUserStatusType.Revoked:\n                // Revoked users may not be (auto)‑provisioned\n                throw new Exception(\n                    _i18nService.T(\"OrganizationUserAccessRevoked\", organizationDisplayNameForLogging));\n            default:\n                // anything else is “unknown”\n                throw new Exception(\n                    _i18nService.T(\"OrganizationUserUnknownStatus\", organizationDisplayNameForLogging));\n        }\n    }\n\n    private IActionResult InvalidJson(string errorMessageKey, Exception? ex = null)\n    {\n        Response.StatusCode = ex == null ? 400 : 500;\n        return Json(new ErrorResponseModel(_i18nService.T(errorMessageKey))\n        {\n            ExceptionMessage = ex?.Message,\n            ExceptionStackTrace = ex?.StackTrace,\n            InnerExceptionMessage = ex?.InnerException?.Message,\n        });\n    }\n\n    private string? TryGetEmailAddressFromClaims(IEnumerable<Claim> claims, IEnumerable<string> additionalClaimTypes)\n    {\n        var filteredClaims = claims.Where(c => !string.IsNullOrWhiteSpace(c.Value) && c.Value.Contains(\"@\"));","sourceCodeStart":875,"sourceCodeEnd":911,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Controllers/AccountController.cs#L875-L911","documentation":"Thrown by EnforceAllowedOrgUserStatus as a default/fallback case when the organization user's status is not in the allowed list and is not explicitly Revoked. This represents an unexpected or newly added OrganizationUserStatusType enum value that the SSO flow does not handle, indicating a code/data mismatch.","triggerScenarios":"An OrganizationUserStatusType enum value is present in the database that is neither in the allowed statuses list nor Revoked (e.g., a future enum value added without updating this switch). This is effectively a defensive guard for unmapped statuses.","commonSituations":"A new OrganizationUserStatusType was added to the enum but the SSO allowed-statuses arrays were not updated. Database corruption or manual data manipulation set an invalid integer status. A version mismatch between server components.","solutions":["Inspect the OrganizationUser.Status value in the database for the affected user to identify the unmapped enum.","If a new status was added to OrganizationUserStatusType, update the allowedStatuses arrays in the calling code (e.g., PreventOrgUserLoginIfStatusInvalidAsync).","Correct the user's status in the database to a known valid value (Invited/Accepted/Confirmed) if it was corrupted.","Ensure all server components (API, SSO, Identity) are on compatible versions that share the same enum definitions."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate that the status is within the known enum range\nif (!Enum.IsDefined(typeof(OrganizationUserStatusType), orgUser.Status))\n{\n    _logger.LogError(\"Unknown OrganizationUserStatusType {Status} for user {UserId}\", orgUser.Status, orgUser.UserId);\n    return StatusCode(500, \"Unexpected user status.\");\n}","typeGuard":"static bool IsKnownStatus(OrganizationUserStatusType status)\n    => Enum.IsDefined(typeof(OrganizationUserStatusType), status);","tryCatchPattern":"try { await EnforceAllowedOrgUserStatus(status, allowed, orgName); }\ncatch (Exception ex) when (ex.Message.Contains(\"OrganizationUserUnknownStatus\"))\n{ /* Log the raw int status value for investigation; this indicates an enum/code mismatch */ }","preventionTips":["When adding a new OrganizationUserStatusType enum value, search the codebase for all allowedStatuses arrays and update them.","Add a database constraint or migration validation that OrganizationUser.Status values are within the known enum range.","Keep all server projects (API, SSO, Identity) version-aligned to share enum definitions."],"tags":["sso","authentication","enum","organization-user","bitwarden-license"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}