bitwarden/server · error · Exception

SAMLart parameter detected. SAML Artifact binding is not all

Error message

SAMLart parameter detected. SAML Artifact binding is not allowed.

What it means

Thrown by SsoAuthenticationMiddleware when an incoming HTTP request contains a 'SAMLart' query parameter (GET) or form field (POST). SAML Artifact binding is an alternative SAML binding that redirects through an artifact resolution service; Bitwarden explicitly rejects it for security and complexity reasons, allowing only POST and Redirect bindings.

Source

Thrown at bitwarden_license/src/Sso/Utilities/SsoAuthenticationMiddleware.cs:25

public class SsoAuthenticationMiddleware
{
    private readonly RequestDelegate _next;

    public SsoAuthenticationMiddleware(RequestDelegate next, IAuthenticationSchemeProvider schemes)
    {
        _next = next ?? throw new ArgumentNullException(nameof(next));
        Schemes = schemes ?? throw new ArgumentNullException(nameof(schemes));
    }

    public IAuthenticationSchemeProvider Schemes { get; set; }

    public async Task Invoke(HttpContext context)
    {
        if ((context.Request.Method == "GET" && context.Request.Query.ContainsKey("SAMLart"))
            || (context.Request.Method == "POST" && context.Request.Form.ContainsKey("SAMLart")))
        {
            throw new Exception("SAMLart parameter detected. SAML Artifact binding is not allowed.");
        }

        context.Features.Set<IAuthenticationFeature>(new AuthenticationFeature
        {
            OriginalPath = context.Request.Path,
            OriginalPathBase = context.Request.PathBase
        });

        // Give any IAuthenticationRequestHandler schemes a chance to handle the request
        var handlers = context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();
        foreach (var scheme in await Schemes.GetRequestHandlerSchemesAsync())
        {
            // Determine if scheme is appropriate for the current context FIRST
            if (scheme is IDynamicAuthenticationScheme dynamicScheme)
            {
                switch (dynamicScheme.SsoType)
                {
                    case SsoType.OpenIdConnect:

View on GitHub (pinned to e93b962371)

Solutions

1. Reconfigure the identity provider to use HTTP-POST or HTTP-Redirect binding for SAML responses instead of HTTP-Artifact.
2. In ADFS: edit the Relying Party Trust and set the binding to 'POST'. In Azure AD/Entra: check the SAML response binding setting in the enterprise application.
3. Verify the IdP's metadata to confirm the AssertionConsumerService binding matches urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST.
4. If Artifact binding is a hard requirement, this is a product limitation — file a feature request, as the middleware unconditionally blocks it.

// Client-side: detect and warn about Artifact binding before submitting
if (samlResponseUrl.includes('SAMLart=')) {
    alert('Your identity provider is using SAML Artifact binding, which is not supported. Please contact your IdP administrator to switch to POST or Redirect binding.');
    return;
}

// Global exception handler in Startup/Program
app.UseExceptionHandler(ex => ex.Run(async context =>
{
    if (context.Features.Get<IExceptionHandlerPathFeature>()?.Error is Exception ex
        && ex.Message.Contains("SAMLart"))
    {
        context.Response.StatusCode = 400;
        await context.Response.WriteAsync("SAML Artifact binding is not supported. Configure your IdP to use POST or Redirect binding.");
    }
}));

When it happens

Trigger: An identity provider (IdP) is configured to use SAML Artifact binding, causing it to send a SAMLart parameter in the assertion response. The middleware detects this before any authentication handler runs and throws immediately.

Common situations: The IdP's SAML binding settings were changed to Artifact (often labeled 'HTTP-Artifact' in IdP admin consoles like ADFS, OneLogin, or Azure AD). A new IdP integration defaults to Artifact binding. An IdP falls back to Artifact when POST binding fails.

Related errors

• Cannot verify SAML assertion signature.
• UserIdAndTokenMismatch
• InvalidReturnUrl
• SsoOrganizationIdMismatch
• AcrMissingOrInvalid

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/1afea7a1f7187a50. Report an issue: GitHub.