{"record":{"id":"93f1f4e7a49ba68c","repo":"bitwarden/server","slug":"nodomainhintprovided","errorCode":null,"errorMessage":"NoDomainHintProvided","messagePattern":"NoDomainHintProvided","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Controllers/AccountController.cs","lineNumber":170,"sourceCode":"        }\n        catch (Exception ex)\n        {\n            _logger.LogError(ex, \"An error occurred during SSO prevalidation.\");\n            return InvalidJson(\"SsoInvalidIdentifierError\");\n        }\n    }\n\n    [HttpGet]\n    public async Task<IActionResult> LoginAsync(string returnUrl)\n    {\n        var context = await _interaction.GetAuthorizationContextAsync(returnUrl);\n\n        // FIXME: Update this file to be null safe and then delete the line below\n#nullable disable\n        if (!context.Parameters.AllKeys.Contains(\"domain_hint\") ||\n            string.IsNullOrWhiteSpace(context.Parameters[\"domain_hint\"]))\n        {\n            throw new Exception(_i18nService.T(\"NoDomainHintProvided\"));\n        }\n\n        var ssoToken = context.Parameters[SsoTokenable.TokenIdentifier];\n\n        if (string.IsNullOrWhiteSpace(ssoToken))\n        {\n            return Unauthorized(\"A valid SSO token is required to continue with SSO login\");\n        }\n\n        var domainHint = context.Parameters[\"domain_hint\"];\n        var organization = await _organizationRepository.GetByIdentifierAsync(domainHint);\n#nullable restore\n\n        if (organization == null)\n        {\n            return InvalidJson(\"OrganizationNotFoundByIdentifierError\");\n        }\n","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Controllers/AccountController.cs#L152-L188","documentation":"Thrown in AccountController.LoginAsync (line 170) when the IdentityServer authorization context parameters do not contain a 'domain_hint' key or its value is blank. The domain_hint identifies which organization's SSO configuration to use for login.","triggerScenarios":"A GET request to the Login endpoint with a returnUrl whose authorization context (from _interaction.GetAuthorizationContextAsync) has no 'domain_hint' parameter or an empty/whitespace one.","commonSituations":"The SSO login flow was initiated without the web client passing domain_hint in the authorize request; returnUrl was constructed incorrectly; the client deep-linked into /login without going through PreValidate which captures the domain hint; browser stripped query params.","solutions":["Ensure the authorize/redirect URL that starts the SSO flow always includes a non-empty domain_hint parameter.","Verify the web client's SSO initiation code passes the organization identifier as domain_hint.","Check that returnUrl is not URL-decoded or truncated before reaching LoginAsync."],"exampleFix":"// before — client omits domain_hint\nvar authorizeUrl = $\"/sso/login?returnUrl={encodedReturn}\";\n// after — include domain_hint in the authorize parameters\nvar authorizeUrl = $\"/connect/authorize?domain_hint={orgIdentifier}&returnUrl={encodedReturn}&...\";","handlingStrategy":"validation","validationCode":"// Client-side: ensure domain_hint is present before redirecting to /sso/login\nif (string.IsNullOrWhiteSpace(domainHint))\n    throw new InvalidOperationException(\"domain_hint is required for SSO login.\");\nvar authorizeUrl = $\"/connect/authorize?domain_hint={domainHint}&...\";","typeGuard":null,"tryCatchPattern":"try { await _accountController.LoginAsync(returnUrl); }\ncatch (Exception ex) when (ex.Message.Contains(\"NoDomainHintProvided\"))\n{ /* redirect to org selection page */ }","preventionTips":["Always start SSO from the web client's org-specific SSO button, which injects domain_hint.","Run PreValidate (which also checks domainHint) before navigating to Login.","Log when domain_hint is missing to identify client-side flow bugs."],"tags":["sso","authentication","domain-hint","configuration","identity-server"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}