bitwarden/server · error · Exception

OrganizationUserAccessRevoked

Error message

OrganizationUserAccessRevoked

What it means

Thrown by EnforceAllowedOrgUserStatus when an organization user's status is Revoked and 'Revoked' is not in the allowed-statuses list for the current SSO operation. Revoked users are explicitly blocked from being auto-provisioned or completing SSO login. The organization display name is included in the message for logging context.

Source

Thrown at bitwarden_license/src/Sso/Controllers/AccountController.cs:889

    }

    private void EnforceAllowedOrgUserStatus(
        OrganizationUserStatusType statusToCheckAgainst,
        OrganizationUserStatusType[] allowedStatuses,
        string organizationDisplayNameForLogging)
    {
        // if this status is one of the allowed ones, just return
        if (allowedStatuses.Contains(statusToCheckAgainst))
        {
            return;
        }

        // otherwise throw the appropriate exception
        switch (statusToCheckAgainst)
        {
            case OrganizationUserStatusType.Revoked:
                // Revoked users may not be (auto)‑provisioned
                throw new Exception(
                    _i18nService.T("OrganizationUserAccessRevoked", organizationDisplayNameForLogging));
            default:
                // anything else is “unknown”
                throw new Exception(
                    _i18nService.T("OrganizationUserUnknownStatus", organizationDisplayNameForLogging));
        }
    }

    private IActionResult InvalidJson(string errorMessageKey, Exception? ex = null)
    {
        Response.StatusCode = ex == null ? 400 : 500;
        return Json(new ErrorResponseModel(_i18nService.T(errorMessageKey))
        {
            ExceptionMessage = ex?.Message,
            ExceptionStackTrace = ex?.StackTrace,
            InnerExceptionMessage = ex?.InnerException?.Message,
        });
    }

View on GitHub (pinned to e93b962371)

Solutions

  1. Have an organization admin restore (un-revoke) the user's organization membership before SSO login is attempted.
  2. If the revocation was intentional, communicate to the user that their access has been revoked.
  3. Check the OrganizationUser table for the user's current Status to confirm it is Revoked (value 2) before re-inviting.
  4. Re-invite the user through the admin console to reset their status to Invited.
Defensive patterns

Strategy: validation

Validate before calling

// Check org user status before attempting SSO login
var orgUser = await organizationUserRepository.GetByOrganizationUserAsync(orgId, userId);
if (orgUser?.Status == OrganizationUserStatusType.Revoked)
{
    return Forbid("User access has been revoked. Contact an organization admin.");
}

Type guard

static bool IsRevokedOrgUser(OrganizationUser? ou)
    => ou?.Status == OrganizationUserStatusType.Revoked;

Try / catch

try { await loginService.SsoLoginAsync(user, provider); }
catch (Exception ex) when (ex.Message.Contains("OrganizationUserAccessRevoked"))
{ /* Redirect to a 'your access has been revoked' page with a contact-admin message */ }

Prevention

When it happens

Trigger: A user whose OrganizationUser.Status == Revoked attempts to log in via SSO. This can occur during the login status check (PreventOrgUserLoginIfStatusInvalidAsync) where allowed statuses are Invited, Accepted, or Confirmed — Revoked is not among them.

Common situations: An admin revoked the user's access, but the user still has an active SSO session or bookmarked SSO URL. The user was revoked as part of offboarding but attempts to authenticate before being re-invited.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/e38375e9a065fa06. Report an issue: GitHub.