bitwarden/server · error · Exception

CouldNotFindOrganizationUser

Error message

CouldNotFindOrganizationUser

What it means

Thrown in AccountController.PreventOrgUserLoginIfStatusInvalidAsync (line 779) after the resolved user has been signed in or is about to be. The method lazily resolves organization (from provider) and orgUser (by user+org or email). If orgUser is still null after all lookups, the user has no OrganizationUser record for this organization, which is an invalid state for SSO login.

Source

Thrown at bitwarden_license/src/Sso/Controllers/AccountController.cs:779

            user,
            organization.Id,
            user.Email);

        if (orgUser != null)
        {
            // Invited is allowed at this point because we know the user is trying to accept an org invite.
            EnforceAllowedOrgUserStatus(
                orgUser.Status,
                allowedStatuses: [
                    OrganizationUserStatusType.Invited,
                    OrganizationUserStatusType.Accepted,
                    OrganizationUserStatusType.Confirmed,
                ],
                organization.DisplayName());
        }
        else
        {
            throw new Exception(_i18nService.T("CouldNotFindOrganizationUser", user.Id, organization.Id));
        }
    }

    private async Task<User?> GetUserFromManualLinkingDataAsync(string userIdentifier)
    {
        User? user = null;
        var split = userIdentifier.Split(",");
        if (split.Length < 2)
        {
            throw new Exception(_i18nService.T("InvalidUserIdentifier"));
        }

        var userId = split[0];
        var token = split[1];

        var tokenOptions = new TokenOptions();

        var claimedUser = await _userService.GetUserByIdAsync(userId);

View on GitHub (pinned to e93b962371)

Solutions

  1. Verify the user has an active OrganizationUser record for the organization (check via admin portal or database).
  2. If the membership was revoked or deleted, have an admin re-invite the user.
  3. Investigate server logs for any deletion or status-change events that occurred during the SSO flow.
  4. Check for email mismatches between the User record and OrganizationUser invite email.
Defensive patterns

Strategy: validation

Validate before calling

// Before calling PreventOrgUserLoginIfStatusInvalidAsync, verify orgUser exists
var orgUser = await GetOrganizationUserByUserAndOrgIdOrEmailAsync(user, orgId, user.Email);
if (orgUser == null)
    return BadRequest($"No organization user found for user {user.Id} in org {orgId}.");

Try / catch

try { await PreventOrgUserLoginIfStatusInvalidAsync(organization, provider, orgUser, user); }
catch (Exception ex) when (ex.Message.Contains("CouldNotFindOrganizationUser"))
{ /* log user.Id + org.Id; instruct admin to re-invite user */ }

Prevention

When it happens

Trigger: After the provisioning flow, PreventOrgUserLoginIfStatusInvalidAsync is called with a null orgUser. The lazy lookup by GetOrganizationUserByUserAndOrgIdOrEmailAsync (by user ID then by email) returns null, meaning no OrganizationUser exists for this user in this org.

Common situations: The OrganizationUser was deleted between provisioning and this check; the user's email changed so the email-based lookup fails; a race condition removed the membership; the provisioning path returned a user but not an orgUser and the lazy resolution fails.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/cf9e4cb99722ebde. Report an issue: GitHub.