bitwarden/server · error · Exception

SSOProviderIsNotAnOrgId

Error message

SSOProviderIsNotAnOrgId

What it means

Thrown during SSO login resolution when the 'provider' value — which Bitwarden uses as the organization identifier in the SSO scheme — cannot be parsed as a GUID. Bitwarden identifies SSO configurations per organization, not per identity provider, so the provider string must be a valid organization GUID.

Source

Thrown at bitwarden_license/src/Sso/Controllers/AccountController.cs:826

                throw new Exception(_i18nService.T("UserIdAndTokenMismatch"));
            }
        }

        return user;
    }

    /// <summary>
    /// Tries to get the organization by the provider which is org id for us as we use the scheme
    /// to identify organizations - not identity providers.
    /// </summary>
    /// <param name="provider">Org id string from SSO scheme property</param>
    /// <exception cref="Exception">Errors if the provider string is not a valid org id guid or if the org cannot be found by the id.</exception>
    private async Task<Organization> GetOrganizationByProviderAsync(string provider)
    {
        if (!Guid.TryParse(provider, out var organizationId))
        {
            // TODO: support non-org (server-wide) SSO in the future?
            throw new Exception(_i18nService.T("SSOProviderIsNotAnOrgId", provider));
        }

        var organization = await _organizationRepository.GetByIdAsync(organizationId);

        if (organization == null)
        {
            throw new Exception(_i18nService.T("CouldNotFindOrganization", organizationId));
        }

        return organization;
    }

    /// <summary>
    /// Attempts to get an <see cref="OrganizationUser"/> for a given organization
    /// by first checking for an existing user relationship, and if none is found,
    /// by looking up an invited user via their email address.
    /// </summary>
    /// <param name="user">The existing user entity to be looked up in OrganizationUsers table.</param>

View on GitHub (pinned to e93b962371)

Solutions

1. Verify the SSO redirect/initiation URL includes the correct organization GUID as the provider parameter.
2. Check the SSO scheme registration in the database (SsoConfig) to ensure the scheme name resolves to a valid organization ID.
3. If the error appears after a migration, confirm organization IDs were preserved and not reformatted.
4. Ensure no middleware or proxy strips or rewrites the provider segment of the SSO callback URL.

Example fix

// before: provider passed as org name
var provider = "My Organization";
// after: provider passed as org GUID
var provider = organization.Id.ToString();

// Validate the provider is a GUID before initiating SSO
if (!Guid.TryParse(provider, out var orgId))
{
    return BadRequest($"SSO provider must be a valid organization GUID, got: {provider}");
}

static bool IsValidSsoProvider(string provider) => Guid.TryParse(provider, out _);

try { var org = await GetOrganizationByProviderAsync(provider); }
catch (Exception ex) when (ex.Message.Contains("SSOProviderIsNotAnOrgId"))
{ /* The SSO configuration's scheme/provider is not an org GUID — fix the SSO config */ }

When it happens

Trigger: The SSO scheme/configuration is invoked with a provider value that is not a GUID string (e.g., a display name, a URL, or an empty string). This typically originates from a misconfigured SSO client redirect or a corrupted scheme registration.

Common situations: An administrator edits the SSO configuration URL or client to use a non-GUID identifier. A deployment or migration corrupts the stored scheme provider value. A test or staging environment passes the wrong identifier.

Related errors

• InvalidUserIdentifier
• NoDomainHintProvided
• InvalidSsoToken
• ExternalAuthenticationError
• OrganizationOrSsoConfigNotFound

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/99fcfdc797637209. Report an issue: GitHub.