{"record":{"id":"969303ba19b9a213","repo":"bitwarden/server","slug":"useralreadyexistskeyconnector","errorCode":null,"errorMessage":"UserAlreadyExistsKeyConnector","messagePattern":"UserAlreadyExistsKeyConnector","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Controllers/AccountController.cs","lineNumber":568,"sourceCode":"        }\n\n        // Find the org (we error if we can't find an org because no org is not valid)\n        var organization = await GetOrganizationByProviderAsync(provider);\n\n        // Try to find an org user (null org user possible and valid here)\n        var possibleOrgUser = await GetOrganizationUserByUserAndOrgIdOrEmailAsync(possibleExistingUser, organization.Id, email);\n\n        //----------------------------------------------------\n        // Scenario 1: We've found the user in the User table\n        //----------------------------------------------------\n        if (possibleExistingUser != null)\n        {\n            User guaranteedExistingUser = possibleExistingUser;\n\n            if (guaranteedExistingUser.UsesKeyConnector &&\n                (possibleOrgUser == null || possibleOrgUser.Status == OrganizationUserStatusType.Invited))\n            {\n                throw new Exception(_i18nService.T(\"UserAlreadyExistsKeyConnector\"));\n            }\n\n            OrganizationUser guaranteedOrgUser = possibleOrgUser ?? throw new SsoAuthnRequiresOrgMembershipException(\n                organization.Id,\n                organization.DisplayName(),\n                guaranteedExistingUser.Email);\n\n            /*\n             * ----------------------------------------------------\n             *              Critical Code Check Here\n             *\n             * We want to ensure a user is not in the invited state\n             * explicitly. Users in the invited state cannot complete\n             * SSO authentication. Instead of failing with a server\n             * error page, we throw a typed exception so the SSO\n             * callback can redirect the user back to the web client's\n             * /login with a toast prompting them to sign in with their\n             * master password and accept the invite first.","sourceCodeStart":550,"sourceCodeEnd":586,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Controllers/AccountController.cs#L550-L586","documentation":"Thrown in AccountController.CreateUserAndOrgUserConditionallyAsync (line 568) when an existing user has UsesKeyConnector = true but there is no OrganizationUser for this org, or the OrganizationUser is in Invited status. Key Connector users have their key stored externally and cannot be provisioned through the standard SSO JIT path.","triggerScenarios":"An existing User record with UsesKeyConnector=true attempts SSO login, and either possibleOrgUser is null (not a member of the org) or possibleOrgUser.Status == OrganizationUserStatusType.Invited.","commonSituations":"A Key Connector-enabled user is invited to a new org but hasn't been confirmed; org admin revoked or the user was removed from the org; Key Connector deployment changed but user flags weren't updated.","solutions":["Ensure the Key Connector user is a confirmed member of the organization before SSO login (status must be Accepted or Confirmed).","Have an org admin re-invite and confirm the user's org membership.","If the user should not use Key Connector, clear the UsesKeyConnector flag before SSO login."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Before SSO login, verify Key Connector user's org membership\nif (existingUser.UsesKeyConnector)\n{\n    var orgUser = await _organizationUserRepository.GetByOrganizationAsync(orgId, existingUser.Email);\n    if (orgUser == null || orgUser.Status == OrganizationUserStatusType.Invited)\n        return BadRequest(\"Key Connector users must be confirmed org members before SSO login.\");\n}","typeGuard":null,"tryCatchPattern":"try { await CreateUserAndOrgUserConditionallyAsync(...); }\ncatch (Exception ex) when (ex.Message.Contains(\"UserAlreadyExistsKeyConnector\"))\n{ /* instruct admin to confirm the user's org membership */ }","preventionTips":["Confirm Key Connector users' org memberships (Accepted/Confirmed) before enabling SSO for them.","Coordinate Key Connector onboarding with org invitations.","Audit UsesKeyConnector flag when users change orgs."],"tags":["sso","authentication","key-connector","organization","membership","provisioning"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}