{"record":{"id":"7e02fb796c6bb95d","repo":"bitwarden/server","slug":"couldnotfindorganization","errorCode":null,"errorMessage":"CouldNotFindOrganization","messagePattern":"CouldNotFindOrganization","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Controllers/AccountController.cs","lineNumber":833,"sourceCode":"    /// <summary>\n    /// Tries to get the organization by the provider which is org id for us as we use the scheme\n    /// to identify organizations - not identity providers.\n    /// </summary>\n    /// <param name=\"provider\">Org id string from SSO scheme property</param>\n    /// <exception cref=\"Exception\">Errors if the provider string is not a valid org id guid or if the org cannot be found by the id.</exception>\n    private async Task<Organization> GetOrganizationByProviderAsync(string provider)\n    {\n        if (!Guid.TryParse(provider, out var organizationId))\n        {\n            // TODO: support non-org (server-wide) SSO in the future?\n            throw new Exception(_i18nService.T(\"SSOProviderIsNotAnOrgId\", provider));\n        }\n\n        var organization = await _organizationRepository.GetByIdAsync(organizationId);\n\n        if (organization == null)\n        {\n            throw new Exception(_i18nService.T(\"CouldNotFindOrganization\", organizationId));\n        }\n\n        return organization;\n    }\n\n    /// <summary>\n    /// Attempts to get an <see cref=\"OrganizationUser\"/> for a given organization\n    /// by first checking for an existing user relationship, and if none is found,\n    /// by looking up an invited user via their email address.\n    /// </summary>\n    /// <param name=\"user\">The existing user entity to be looked up in OrganizationUsers table.</param>\n    /// <param name=\"organizationId\">Organization id from the provider data.</param>\n    /// <param name=\"email\">Email to use as a fallback in case of an invited user not in the Org Users\n    /// table yet.</param>\n    private async Task<OrganizationUser?> GetOrganizationUserByUserAndOrgIdOrEmailAsync(\n        User? user,\n        Guid organizationId,\n        string? email)","sourceCodeStart":815,"sourceCodeEnd":851,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Controllers/AccountController.cs#L815-L851","documentation":"Thrown during SSO login when the provider GUID is successfully parsed but no Organization record exists in the database for that ID. This means the SSO scheme references an organization that has been deleted, never existed, or lives in a different database/environment.","triggerScenarios":"The SSO callback's provider value resolves to a valid GUID, but _organizationRepository.GetByIdAsync returns null. Common when the org was deleted after the SSO config was created, or when pointing SSO at a different environment's org ID.","commonSituations":"An organization was deleted but its SSO configuration persisted. Cross-environment misconfiguration (staging org ID used against production). A typo in the org ID in a custom SSO initiation URL.","solutions":["Confirm the organization still exists in the database (SELECT * FROM Organization WHERE Id = @orgId).","Verify you are hitting the correct environment (cloud vs. self-hosted) for the organization in question.","If the org was deleted, remove its orphaned SsoConfig record and reconfigure SSO for the correct org.","Ensure the provider value in the SSO URL matches the actual organization GUID exactly."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check org existence before SSO login\nvar org = await organizationRepository.GetByIdAsync(orgId);\nif (org == null)\n{\n    return NotFound($\"Organization {orgId} not found.\");\n}","typeGuard":null,"tryCatchPattern":"try { var org = await GetOrganizationByProviderAsync(provider); }\ncatch (Exception ex) when (ex.Message.Contains(\"CouldNotFindOrganization\"))\n{ /* Org was deleted or the ID is from a different environment */ }","preventionTips":["Cascade-delete or clean up SsoConfig records when an organization is deleted.","Validate org existence during SSO configuration setup, not just at login time.","Use consistent org GUIDs across environments or document the mapping."],"tags":["sso","authentication","data-integrity","bitwarden-license"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}