bitwarden/server · error · Exception

UserAlreadyExistsKeyConnector

Error message

UserAlreadyExistsKeyConnector

What it means

Thrown in AccountController.CreateUserAndOrgUserConditionallyAsync (line 568) when an existing user has UsesKeyConnector = true but there is no OrganizationUser for this org, or the OrganizationUser is in Invited status. Key Connector users have their key stored externally and cannot be provisioned through the standard SSO JIT path.

Source

Thrown at bitwarden_license/src/Sso/Controllers/AccountController.cs:568

        }

        // Find the org (we error if we can't find an org because no org is not valid)
        var organization = await GetOrganizationByProviderAsync(provider);

        // Try to find an org user (null org user possible and valid here)
        var possibleOrgUser = await GetOrganizationUserByUserAndOrgIdOrEmailAsync(possibleExistingUser, organization.Id, email);

        //----------------------------------------------------
        // Scenario 1: We've found the user in the User table
        //----------------------------------------------------
        if (possibleExistingUser != null)
        {
            User guaranteedExistingUser = possibleExistingUser;

            if (guaranteedExistingUser.UsesKeyConnector &&
                (possibleOrgUser == null || possibleOrgUser.Status == OrganizationUserStatusType.Invited))
            {
                throw new Exception(_i18nService.T("UserAlreadyExistsKeyConnector"));
            }

            OrganizationUser guaranteedOrgUser = possibleOrgUser ?? throw new SsoAuthnRequiresOrgMembershipException(
                organization.Id,
                organization.DisplayName(),
                guaranteedExistingUser.Email);

            /*
             * ----------------------------------------------------
             *              Critical Code Check Here
             *
             * We want to ensure a user is not in the invited state
             * explicitly. Users in the invited state cannot complete
             * SSO authentication. Instead of failing with a server
             * error page, we throw a typed exception so the SSO
             * callback can redirect the user back to the web client's
             * /login with a toast prompting them to sign in with their
             * master password and accept the invite first.

View on GitHub (pinned to e93b962371)

Solutions

  1. Ensure the Key Connector user is a confirmed member of the organization before SSO login (status must be Accepted or Confirmed).
  2. Have an org admin re-invite and confirm the user's org membership.
  3. If the user should not use Key Connector, clear the UsesKeyConnector flag before SSO login.
Defensive patterns

Strategy: validation

Validate before calling

// Before SSO login, verify Key Connector user's org membership
if (existingUser.UsesKeyConnector)
{
    var orgUser = await _organizationUserRepository.GetByOrganizationAsync(orgId, existingUser.Email);
    if (orgUser == null || orgUser.Status == OrganizationUserStatusType.Invited)
        return BadRequest("Key Connector users must be confirmed org members before SSO login.");
}

Try / catch

try { await CreateUserAndOrgUserConditionallyAsync(...); }
catch (Exception ex) when (ex.Message.Contains("UserAlreadyExistsKeyConnector"))
{ /* instruct admin to confirm the user's org membership */ }

Prevention

When it happens

Trigger: An existing User record with UsesKeyConnector=true attempts SSO login, and either possibleOrgUser is null (not a member of the org) or possibleOrgUser.Status == OrganizationUserStatusType.Invited.

Common situations: A Key Connector-enabled user is invited to a new org but hasn't been confirmed; org admin revoked or the user was removed from the org; Key Connector deployment changed but user flags weren't updated.

Related errors

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/969303ba19b9a213. Report an issue: GitHub.