{"record":{"id":"a7c1876c309ef80b","repo":"bitwarden/server","slug":"organizationorssoconfignotfound","errorCode":null,"errorMessage":"OrganizationOrSsoConfigNotFound","messagePattern":"OrganizationOrSsoConfigNotFound","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Controllers/AccountController.cs","lineNumber":455,"sourceCode":"    /// The claims on the external identity are used to determine an `externalId`, and that is used to find the appropriate `SsoUser` and `User` records.\n    /// </summary>\n    private async Task<(\n        User? possibleSsoUser,\n        string provider,\n        string providerUserId,\n        IEnumerable<Claim> claims,\n        SsoConfigurationData config\n    )> FindUserFromExternalProviderAsync(AuthenticateResult result)\n    {\n        // FIXME: Update this file to be null safe and then delete the line below\n#nullable disable\n        var provider = result.Properties.Items[\"scheme\"];\n        //Todo: Validate provider is a valid GUID with TryParse instead. When this is invalid it throws an exception\n        var orgId = new Guid(provider);\n        var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(orgId);\n        if (ssoConfig == null || !ssoConfig.Enabled)\n        {\n            throw new Exception(_i18nService.T(\"OrganizationOrSsoConfigNotFound\"));\n        }\n\n        var ssoConfigData = ssoConfig.GetData();\n        var externalUser = result.Principal;\n\n        // Validate acr claim against expectation before going further\n        if (!string.IsNullOrWhiteSpace(ssoConfigData.ExpectedReturnAcrValue))\n        {\n            var acrClaim = externalUser.FindFirst(JwtClaimTypes.AuthenticationContextClassReference);\n            if (acrClaim?.Value != ssoConfigData.ExpectedReturnAcrValue)\n            {\n                throw new Exception(_i18nService.T(\"AcrMissingOrInvalid\"));\n            }\n        }\n\n        // Ensure the NameIdentifier used is not a transient name ID, if so, we need a different attribute\n        //  for the user identifier.\n        static bool nameIdIsNotTransient(Claim c) => c.Type == ClaimTypes.NameIdentifier","sourceCodeStart":437,"sourceCodeEnd":473,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Controllers/AccountController.cs#L437-L473","documentation":"Thrown in AccountController.FindUserFromExternalProviderAsync (line 455) when the SsoConfig for the organization is null or its Enabled property is false. This is checked after resolving the orgId from the external auth scheme and looking up _ssoConfigRepository.GetByOrganizationIdAsync.","triggerScenarios":"The external callback fires for an organization that has no SsoConfig record, or whose SsoConfig.Enabled is false (SSO was disabled by an admin after the flow started).","commonSituations":"Admin disabled or deleted the SSO configuration while a login was in progress; organization was created without SSO setup; SsoConfig was soft-deleted; the wrong organization ID is being used due to a stale scheme.","solutions":["Verify SSO is enabled for the organization in the admin portal (SsoConfig.Enabled = true).","Confirm the organization ID in the auth scheme matches the org with the SSO config.","If SSO was intentionally disabled, inform users and use master password login instead."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify SSO config is enabled before starting the flow\nvar ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(orgId);\nif (ssoConfig == null || !ssoConfig.Enabled)\n    return BadRequest(\"SSO is not enabled for this organization.\");","typeGuard":null,"tryCatchPattern":"try { await FindUserFromExternalProviderAsync(result); }\ncatch (Exception ex) when (ex.Message.Contains(\"OrganizationOrSsoConfigNotFound\"))\n{ /* inform user SSO is not configured; fall back to password */ }","preventionTips":["Run PreValidate before Login to catch disabled/missing SSO config early.","Admins should ensure SsoConfig.Enabled is true before announcing SSO availability.","Monitor for SSO config changes and alert admins when config is disabled mid-flight."],"tags":["sso","authentication","configuration","organization","sso-config"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}