bitwarden/server · warning · SsoAuthnRequiresInviteAcceptanceException

ssoOrgInviteAcceptanceRequired

ssoOrgInviteAcceptanceRequired

Error message

Invite acceptance required before SSO for org '{organizationDisplayName}'.

What it means

Thrown as SsoAuthnRequiresInviteAcceptanceException in AccountController.CreateUserAndOrgUserConditionallyAsync (line 603) when an existing user is a member of the org but their OrganizationUser.Status is Invited. Invited users cannot complete SSO authentication; they must first accept the invitation via email. The typed exception is caught in ExternalCallback and redirects to the login page with an InviteAcceptanceRequired error code so the user can sign in with their master password and accept the invite.

Source

Thrown at bitwarden_license/src/Sso/Controllers/AccountController.cs:603

             * /login with a toast prompting them to sign in with their
             * master password and accept the invite first.
             *
             * The security-critical property is unchanged: no SsoUser
             * row is written and no auth session is established for
             * invited users.
             *
             * See internal doc called "Added Context for SSO Login
             * Flows" for further details.
             * ----------------------------------------------------
             */
            if (guaranteedOrgUser.Status == OrganizationUserStatusType.Invited)
            {
                // Org User is invited – must accept via email first.
                // Use the existing User's email (non-nullable, canonical) rather than the
                // OrganizationUser's invite-target email (nullable) — they refer to the
                // same person in this scenario, and the existing user's email is what
                // the redirected login form will pre-fill.
                throw new SsoAuthnRequiresInviteAcceptanceException(
                    organization.Id,
                    organization.DisplayName(),
                    guaranteedExistingUser.Email);
            }

            // If the user already exists in Bitwarden, we require that the user already be in the org,
            // and that they are either Accepted or Confirmed.
            EnforceAllowedOrgUserStatus(
                guaranteedOrgUser.Status,
                allowedStatuses: [
                    OrganizationUserStatusType.Accepted,
                    OrganizationUserStatusType.Confirmed
                ],
                organization.DisplayName());

            // Since we're in the auto-provisioning logic, this means that the user exists, but they have not
            // authenticated with the org's SSO provider before now (otherwise we wouldn't be auto-provisioning them).
            // We've verified that the user is Accepted or Confirmed, so we can create an SsoUser link and proceed

View on GitHub (pinned to e93b962371)

Solutions

Have the user accept the organization invitation via the email link before attempting SSO login.
Alternatively, the user should sign in with their master password first to accept the invite, then use SSO.
An org admin can resend the invitation if the original email was lost.

Defensive patterns

Strategy: try-catch

Try / catch

// Already handled in ExternalCallback — the typed exception is caught and redirected:
catch (SsoAuthnRequiresInviteAcceptanceException ex)
{
    await HttpContext.SignOutAsync(AuthenticationSchemes.BitwardenExternalCookieAuthenticationScheme);
    var redirectUrl = SsoRedirectUrlBuilder.BuildLoginRedirectUrl(
        _globalSettings.BaseServiceUri.VaultWithHash,
        ex.UserEmail, ex.OrganizationId, ex.OrganizationDisplayName,
        SsoRedirectUrlBuilder.ErrorCodes.InviteAcceptanceRequired);
    return Redirect(redirectUrl);
}

Prevention

Instruct invited users to accept their invitation email before using SSO.
Admins should resend invitations if users report this error.
The web client should detect the InviteAcceptanceRequired code and prompt for master-password sign-in to accept.

When it happens

Trigger: An existing Bitwarden user authenticates via SSO for an org where their OrganizationUser record has Status == OrganizationUserStatusType.Invited.

Common situations: User was invited to the org but hasn't clicked the accept link in the invitation email; admin sent an invite but the user went straight to SSO without accepting.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/032115171815ab87. Report an issue: GitHub.