mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-04-26 01:35:54 +03:00
[GH-ISSUE #6374] SSO: "Failed to retrieve the associated organization" #2413
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#2413
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @mkjeller on GitHub (Oct 19, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6374
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: DOMAIN, ADMIN_TOKEN
Config:
Vaultwarden Build Version
v1.34.3-3f010a50
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
cloudflared
Host/Server Operating System
Linux
Operating System Version
Docker
Clients
Web Vault
Client Version
v2025.9.1
Steps To Reproduce
Expected Result
Master password is saved and login flow continues / user is presented with their brand new vault
Actual Result
The web interface hangs for a few seconds before failing with a toast in the top right corner stating:
Logs
Additional Context
This has been tested with the following settings toggled on and off in various combinations.
The error persists in all cases.
Error does NOT occur if the user creates an account first in the traditional way then goes back and re-attempts SSO login. Email association takes over and the OIDC ID is linked to the account.
SSO logins work from then on, but the user is still prompted for their Master Password (but I believe this is intended behaviour?)
@Timshel commented on GitHub (Oct 22, 2025):
Hey
When logging from the default url, a value for the Identifier is resolved from the email.
If you want to log directly from https://vault.example.domain/#/sso you'll have to set the dummy value:
VW_DUMMY_IDENTIFIER_FOR_OIDC(or the uuid from an organization ).@mkjeller commented on GitHub (Oct 24, 2025):
I'm afraid the issue persists even with that value set in the .env file
(Server ver now: 1.34.3-a85b4851)
@Timshel commented on GitHub (Oct 27, 2025):
The
VW_DUMMY_IDENTIFIER_FOR_OIDCis not an env setting, it's SSO identifier you need to inpurt instead ofTESTSTRING.@mkjeller commented on GitHub (Oct 27, 2025):
Yup, that worked, sorry for the misunderstanding there.
I'll close this issue out now.
@Schweizer-Philipp commented on GitHub (Nov 8, 2025):
Is there a way to configure the invitation link so that the orgSsoIdentifier value is automatically set to either VW_DUMMY_IDENTIFIER_FOR_OIDC or the UUID of an existing organization?
I have self-registration disabled and users can only log in via SSO.
When I manually replace the orgSsoIdentifier in the invitation URL with the correct value, the invited user can register successfully — but I can’t find any configuration option in Vaultwarden to make it use that value automatically.
Currently, the invitation link always contains an empty UUID (00000000-0000-0000-0000-000000000000).
@Timshel commented on GitHub (Nov 8, 2025):
Sounds like a bug I'll check.
@saschabrockel commented on GitHub (Nov 27, 2025):
I have the same bug @Schweizer-Philipp
@Timshel commented on GitHub (Nov 27, 2025):
@Schweizer-Philipp @saschabrockel had a look, had never used the admin invite with SSO; https://github.com/dani-garcia/vaultwarden/pull/6498 should fix the issue.
@CidAlfa commented on GitHub (Dec 31, 2025):
OIDC SSO + Auto-enroll fails with Failed to retrieve the associated organization during master password setup.
Environment
Vaultwarden: latest (Docker)
Keycloak: 24.0.1 (OIDC)
Deployment: Docker + Nginx reverse proxy
OS: Ubuntu
Domain:
Vaultwarden: https://domain.com
Keycloak: https://domain.com
Login mode: SSO_ONLY = true
We are using Vaultwarden with OIDC SSO (Keycloak) and want to automatically enroll all SSO users into a single organization.
SSO login itself works correctly, but during first-time login, when Vaultwarden asks the user to set the master password, the process fails with:
Failed to retrieve the associated organization
This happens consistently on:
POST /api/accounts/set-password
Expected Behavior
After successful OIDC login:
User should be automatically associated with an organization
User should be able to set the master password
Account creation should complete successfully
Actual Behavior
OIDC login succeeds
User reaches the “Set master password” screen
On submit, Vaultwarden returns 400 Bad Request
Log shows:
Failed to retrieve the associated organization
Configuration (important parts)
.env
DOMAIN=https://domain.com
SSO_ENABLED=true
SSO_ONLY=true
SSO_AUTHORITY=https://domain.com/realms/client
SSO_CLIENT_ID=vaultwarden
SSO_CLIENT_SECRET=********
SSO_SCOPES="openid email profile"
SSO_PKCE=true
SIGNUPS_ALLOWED=true
SSO_SIGNUPS_MATCH_EMAIL=true
SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=false
ORG_CREATION_USERS=admin.main@domain.com
VW_DUMMY_IDENTIFIER_FOR_OIDC=442ff294-6c70-498a-8dc2-7fad2a2fc206
We also tested using an organization slug instead of UUID.
Vaultwarden Admin Settings
Allow new signups: ✅ true
Allow invitations: ✅ true
Email domain whitelist: domain.com
Org creation users: admin.main@domain.com
Invitation organization name: Vaultwarden
Only SSO login: ✅ true
Allow email association: ✅ true
Allow unknown email verification status: ❌ false
Organization Details
Organization exists and is visible in Admin UI
Organization has:
Users: 1
Collections: 1
Groups: 0
Organization UUID example:
442ff294-6c70-498a-8dc2-7fad2a2fc206
Logs (important excerpts)
Successful SSO login
[INFO] User xusan logged in successfully.
POST /identity/connect/token => 200 OK
Auto-enroll check (note identifier)
GET /api/organizations/bs.ahmedovhusan@domain.com/auto-enroll-status => 200 OK
Vaultwarden seems to use the email as organization identifier, not the org UUID or slug.
Failure during master password setup
POST /api/accounts/set-password
[ERROR] Failed to retrieve the associated organization
=> 400 Bad Request
This happens every time.
What We Tried
Resetting admin configuration
Recreating the organization
Deleting and re-creating users
Using VW_DUMMY_IDENTIFIER_FOR_OIDC with:
UUID
Organization slug
Restarting containers
Verifying OIDC discovery endpoint
Verifying callback path
Confirmed that /auto-enroll-status returns 200
None of the above resolved the issue.
Observations / Suspected Cause
Vaultwarden tries to resolve organization using email as identifier
VW_DUMMY_IDENTIFIER_FOR_OIDC does not seem to be applied during set-password
Auto-enroll logic succeeds, but organization is not attached to the user context during password creation
Question
What is the correct and supported way to:
Automatically associate OIDC users with an organization
Avoid Failed to retrieve the associated organization during master password setup
Should VW_DUMMY_IDENTIFIER_FOR_OIDC be:
UUID?
Organization slug?
Something else?
Is this a known limitation or a bug in the OIDC + auto-enroll flow?
Additional Notes
We are logging in directly via the Vaultwarden domain (not via email-first flow)
This setup worked earlier but started failing after reconfiguration
We can provide more logs or test patches if needed
@Timshel can you help with fix this problem