bitwarden/server · error · Exception

OrganizationUserUnknownStatus

Error message

OrganizationUserUnknownStatus

What it means

Thrown by EnforceAllowedOrgUserStatus as a default/fallback case when the organization user's status is not in the allowed list and is not explicitly Revoked. This represents an unexpected or newly added OrganizationUserStatusType enum value that the SSO flow does not handle, indicating a code/data mismatch.

Source

Thrown at bitwarden_license/src/Sso/Controllers/AccountController.cs:893

        OrganizationUserStatusType[] allowedStatuses,
        string organizationDisplayNameForLogging)
    {
        // if this status is one of the allowed ones, just return
        if (allowedStatuses.Contains(statusToCheckAgainst))
        {
            return;
        }

        // otherwise throw the appropriate exception
        switch (statusToCheckAgainst)
        {
            case OrganizationUserStatusType.Revoked:
                // Revoked users may not be (auto)‑provisioned
                throw new Exception(
                    _i18nService.T("OrganizationUserAccessRevoked", organizationDisplayNameForLogging));
            default:
                // anything else is “unknown”
                throw new Exception(
                    _i18nService.T("OrganizationUserUnknownStatus", organizationDisplayNameForLogging));
        }
    }

    private IActionResult InvalidJson(string errorMessageKey, Exception? ex = null)
    {
        Response.StatusCode = ex == null ? 400 : 500;
        return Json(new ErrorResponseModel(_i18nService.T(errorMessageKey))
        {
            ExceptionMessage = ex?.Message,
            ExceptionStackTrace = ex?.StackTrace,
            InnerExceptionMessage = ex?.InnerException?.Message,
        });
    }

    private string? TryGetEmailAddressFromClaims(IEnumerable<Claim> claims, IEnumerable<string> additionalClaimTypes)
    {
        var filteredClaims = claims.Where(c => !string.IsNullOrWhiteSpace(c.Value) && c.Value.Contains("@"));

View on GitHub (pinned to e93b962371)

Solutions

1. Inspect the OrganizationUser.Status value in the database for the affected user to identify the unmapped enum.
2. If a new status was added to OrganizationUserStatusType, update the allowedStatuses arrays in the calling code (e.g., PreventOrgUserLoginIfStatusInvalidAsync).
3. Correct the user's status in the database to a known valid value (Invited/Accepted/Confirmed) if it was corrupted.
4. Ensure all server components (API, SSO, Identity) are on compatible versions that share the same enum definitions.

// Validate that the status is within the known enum range
if (!Enum.IsDefined(typeof(OrganizationUserStatusType), orgUser.Status))
{
    _logger.LogError("Unknown OrganizationUserStatusType {Status} for user {UserId}", orgUser.Status, orgUser.UserId);
    return StatusCode(500, "Unexpected user status.");
}

static bool IsKnownStatus(OrganizationUserStatusType status)
    => Enum.IsDefined(typeof(OrganizationUserStatusType), status);

try { await EnforceAllowedOrgUserStatus(status, allowed, orgName); }
catch (Exception ex) when (ex.Message.Contains("OrganizationUserUnknownStatus"))
{ /* Log the raw int status value for investigation; this indicates an enum/code mismatch */ }

When it happens

Trigger: An OrganizationUserStatusType enum value is present in the database that is neither in the allowed statuses list nor Revoked (e.g., a future enum value added without updating this switch). This is effectively a defensive guard for unmapped statuses.

Common situations: A new OrganizationUserStatusType was added to the enum but the SSO allowed-statuses arrays were not updated. Database corruption or manual data manipulation set an invalid integer status. A version mismatch between server components.

Related errors

• OrganizationUserAccessRevoked
• InvalidUserIdentifier
• UserIdAndTokenMismatch
• SSOProviderIsNotAnOrgId
• CouldNotFindOrganization

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/4e8bb1a6af291e7c. Report an issue: GitHub.