{"record":{"id":"99fcfdc797637209","repo":"bitwarden/server","slug":"ssoproviderisnotanorgid","errorCode":null,"errorMessage":"SSOProviderIsNotAnOrgId","messagePattern":"SSOProviderIsNotAnOrgId","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Controllers/AccountController.cs","lineNumber":826,"sourceCode":"                throw new Exception(_i18nService.T(\"UserIdAndTokenMismatch\"));\n            }\n        }\n\n        return user;\n    }\n\n    /// <summary>\n    /// Tries to get the organization by the provider which is org id for us as we use the scheme\n    /// to identify organizations - not identity providers.\n    /// </summary>\n    /// <param name=\"provider\">Org id string from SSO scheme property</param>\n    /// <exception cref=\"Exception\">Errors if the provider string is not a valid org id guid or if the org cannot be found by the id.</exception>\n    private async Task<Organization> GetOrganizationByProviderAsync(string provider)\n    {\n        if (!Guid.TryParse(provider, out var organizationId))\n        {\n            // TODO: support non-org (server-wide) SSO in the future?\n            throw new Exception(_i18nService.T(\"SSOProviderIsNotAnOrgId\", provider));\n        }\n\n        var organization = await _organizationRepository.GetByIdAsync(organizationId);\n\n        if (organization == null)\n        {\n            throw new Exception(_i18nService.T(\"CouldNotFindOrganization\", organizationId));\n        }\n\n        return organization;\n    }\n\n    /// <summary>\n    /// Attempts to get an <see cref=\"OrganizationUser\"/> for a given organization\n    /// by first checking for an existing user relationship, and if none is found,\n    /// by looking up an invited user via their email address.\n    /// </summary>\n    /// <param name=\"user\">The existing user entity to be looked up in OrganizationUsers table.</param>","sourceCodeStart":808,"sourceCodeEnd":844,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Controllers/AccountController.cs#L808-L844","documentation":"Thrown during SSO login resolution when the 'provider' value — which Bitwarden uses as the organization identifier in the SSO scheme — cannot be parsed as a GUID. Bitwarden identifies SSO configurations per organization, not per identity provider, so the provider string must be a valid organization GUID.","triggerScenarios":"The SSO scheme/configuration is invoked with a provider value that is not a GUID string (e.g., a display name, a URL, or an empty string). This typically originates from a misconfigured SSO client redirect or a corrupted scheme registration.","commonSituations":"An administrator edits the SSO configuration URL or client to use a non-GUID identifier. A deployment or migration corrupts the stored scheme provider value. A test or staging environment passes the wrong identifier.","solutions":["Verify the SSO redirect/initiation URL includes the correct organization GUID as the provider parameter.","Check the SSO scheme registration in the database (SsoConfig) to ensure the scheme name resolves to a valid organization ID.","If the error appears after a migration, confirm organization IDs were preserved and not reformatted.","Ensure no middleware or proxy strips or rewrites the provider segment of the SSO callback URL."],"exampleFix":"// before: provider passed as org name\nvar provider = \"My Organization\";\n// after: provider passed as org GUID\nvar provider = organization.Id.ToString();","handlingStrategy":"validation","validationCode":"// Validate the provider is a GUID before initiating SSO\nif (!Guid.TryParse(provider, out var orgId))\n{\n    return BadRequest($\"SSO provider must be a valid organization GUID, got: {provider}\");\n}","typeGuard":"static bool IsValidSsoProvider(string provider) => Guid.TryParse(provider, out _);","tryCatchPattern":"try { var org = await GetOrganizationByProviderAsync(provider); }\ncatch (Exception ex) when (ex.Message.Contains(\"SSOProviderIsNotAnOrgId\"))\n{ /* The SSO configuration's scheme/provider is not an org GUID — fix the SSO config */ }","preventionTips":["Always use organization.Id.ToString() when building SSO scheme names or URLs.","Validate provider values at the SSO configuration entry point, not just at login.","Add an integration test that asserts non-GUID provider values are rejected with a clear error."],"tags":["sso","authentication","configuration","validation","bitwarden-license"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}