{"record":{"id":"e38375e9a065fa06","repo":"bitwarden/server","slug":"organizationuseraccessrevoked","errorCode":null,"errorMessage":"OrganizationUserAccessRevoked","messagePattern":"OrganizationUserAccessRevoked","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"bitwarden_license/src/Sso/Controllers/AccountController.cs","lineNumber":889,"sourceCode":"    }\n\n    private void EnforceAllowedOrgUserStatus(\n        OrganizationUserStatusType statusToCheckAgainst,\n        OrganizationUserStatusType[] allowedStatuses,\n        string organizationDisplayNameForLogging)\n    {\n        // if this status is one of the allowed ones, just return\n        if (allowedStatuses.Contains(statusToCheckAgainst))\n        {\n            return;\n        }\n\n        // otherwise throw the appropriate exception\n        switch (statusToCheckAgainst)\n        {\n            case OrganizationUserStatusType.Revoked:\n                // Revoked users may not be (auto)‑provisioned\n                throw new Exception(\n                    _i18nService.T(\"OrganizationUserAccessRevoked\", organizationDisplayNameForLogging));\n            default:\n                // anything else is “unknown”\n                throw new Exception(\n                    _i18nService.T(\"OrganizationUserUnknownStatus\", organizationDisplayNameForLogging));\n        }\n    }\n\n    private IActionResult InvalidJson(string errorMessageKey, Exception? ex = null)\n    {\n        Response.StatusCode = ex == null ? 400 : 500;\n        return Json(new ErrorResponseModel(_i18nService.T(errorMessageKey))\n        {\n            ExceptionMessage = ex?.Message,\n            ExceptionStackTrace = ex?.StackTrace,\n            InnerExceptionMessage = ex?.InnerException?.Message,\n        });\n    }","sourceCodeStart":871,"sourceCodeEnd":907,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Sso/Controllers/AccountController.cs#L871-L907","documentation":"Thrown by EnforceAllowedOrgUserStatus when an organization user's status is Revoked and 'Revoked' is not in the allowed-statuses list for the current SSO operation. Revoked users are explicitly blocked from being auto-provisioned or completing SSO login. The organization display name is included in the message for logging context.","triggerScenarios":"A user whose OrganizationUser.Status == Revoked attempts to log in via SSO. This can occur during the login status check (PreventOrgUserLoginIfStatusInvalidAsync) where allowed statuses are Invited, Accepted, or Confirmed — Revoked is not among them.","commonSituations":"An admin revoked the user's access, but the user still has an active SSO session or bookmarked SSO URL. The user was revoked as part of offboarding but attempts to authenticate before being re-invited.","solutions":["Have an organization admin restore (un-revoke) the user's organization membership before SSO login is attempted.","If the revocation was intentional, communicate to the user that their access has been revoked.","Check the OrganizationUser table for the user's current Status to confirm it is Revoked (value 2) before re-inviting.","Re-invite the user through the admin console to reset their status to Invited."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check org user status before attempting SSO login\nvar orgUser = await organizationUserRepository.GetByOrganizationUserAsync(orgId, userId);\nif (orgUser?.Status == OrganizationUserStatusType.Revoked)\n{\n    return Forbid(\"User access has been revoked. Contact an organization admin.\");\n}","typeGuard":"static bool IsRevokedOrgUser(OrganizationUser? ou)\n    => ou?.Status == OrganizationUserStatusType.Revoked;","tryCatchPattern":"try { await loginService.SsoLoginAsync(user, provider); }\ncatch (Exception ex) when (ex.Message.Contains(\"OrganizationUserAccessRevoked\"))\n{ /* Redirect to a 'your access has been revoked' page with a contact-admin message */ }","preventionTips":["Display the user's org membership status in the admin console before they attempt SSO.","When revoking a user, notify them that SSO login will no longer work.","Build a pre-login status check endpoint so clients can show a clear message before SSO redirect."],"tags":["sso","authentication","authorization","organization-user","bitwarden-license"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}