bitwarden/server · error · Exception

CouldNotFindOrganization

Error message

CouldNotFindOrganization

What it means

Thrown during SSO login when the provider GUID is successfully parsed but no Organization record exists in the database for that ID. This means the SSO scheme references an organization that has been deleted, never existed, or lives in a different database/environment.

Source

Thrown at bitwarden_license/src/Sso/Controllers/AccountController.cs:833

    /// <summary>
    /// Tries to get the organization by the provider which is org id for us as we use the scheme
    /// to identify organizations - not identity providers.
    /// </summary>
    /// <param name="provider">Org id string from SSO scheme property</param>
    /// <exception cref="Exception">Errors if the provider string is not a valid org id guid or if the org cannot be found by the id.</exception>
    private async Task<Organization> GetOrganizationByProviderAsync(string provider)
    {
        if (!Guid.TryParse(provider, out var organizationId))
        {
            // TODO: support non-org (server-wide) SSO in the future?
            throw new Exception(_i18nService.T("SSOProviderIsNotAnOrgId", provider));
        }

        var organization = await _organizationRepository.GetByIdAsync(organizationId);

        if (organization == null)
        {
            throw new Exception(_i18nService.T("CouldNotFindOrganization", organizationId));
        }

        return organization;
    }

    /// <summary>
    /// Attempts to get an <see cref="OrganizationUser"/> for a given organization
    /// by first checking for an existing user relationship, and if none is found,
    /// by looking up an invited user via their email address.
    /// </summary>
    /// <param name="user">The existing user entity to be looked up in OrganizationUsers table.</param>
    /// <param name="organizationId">Organization id from the provider data.</param>
    /// <param name="email">Email to use as a fallback in case of an invited user not in the Org Users
    /// table yet.</param>
    private async Task<OrganizationUser?> GetOrganizationUserByUserAndOrgIdOrEmailAsync(
        User? user,
        Guid organizationId,
        string? email)

View on GitHub (pinned to e93b962371)

Solutions

  1. Confirm the organization still exists in the database (SELECT * FROM Organization WHERE Id = @orgId).
  2. Verify you are hitting the correct environment (cloud vs. self-hosted) for the organization in question.
  3. If the org was deleted, remove its orphaned SsoConfig record and reconfigure SSO for the correct org.
  4. Ensure the provider value in the SSO URL matches the actual organization GUID exactly.
Defensive patterns

Strategy: validation

Validate before calling

// Check org existence before SSO login
var org = await organizationRepository.GetByIdAsync(orgId);
if (org == null)
{
    return NotFound($"Organization {orgId} not found.");
}

Try / catch

try { var org = await GetOrganizationByProviderAsync(provider); }
catch (Exception ex) when (ex.Message.Contains("CouldNotFindOrganization"))
{ /* Org was deleted or the ID is from a different environment */ }

Prevention

When it happens

Trigger: The SSO callback's provider value resolves to a valid GUID, but _organizationRepository.GetByIdAsync returns null. Common when the org was deleted after the SSO config was created, or when pointing SSO at a different environment's org ID.

Common situations: An organization was deleted but its SSO configuration persisted. Cross-environment misconfiguration (staging org ID used against production). A typo in the org ID in a custom SSO initiation URL.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/7e02fb796c6bb95d. Report an issue: GitHub.