[PM-21772] Show key connector domain for new sso users (#15381)

* Passed in userId on RemovePasswordComponent.

* Added userId on other references to KeyConnectorService methods

* remove password component refactor, test coverage, enabled strict

* explicit user id provided to key connector service

* redirect to / instead when user not logged in or not managing organization

* key connector service explicit user id

* key connector service no longer requires account service

* key connector service missing null type

* cli convert to key connector unit tests

* remove unnecessary SyncService

* error toast not showing on ErrorResponse

* bad import due to merge conflict

* bad import due to merge conflict

* missing loading in remove password component for browser extension

* error handling in remove password component

* organization observable race condition in key-connector

* usesKeyConnector always returns boolean

* unit test coverage

* key connector reactive

* reactive key connector service

* introducing convertAccountRequired$

* cli build fix

* moving message sending side effect to sync

* key connector service unit tests

* fix unit tests

* move key connector components to KM team ownership

* new unit tests in wrong place

* key connector domain shown in remove password component

* type safety improvements

* convert to key connector command localization

* key connector domain in convert to key connector command

* convert to key connector command unit tests with prompt assert

* organization name placement change in the remove password component

* unit test update

* show key connector domain for new sso users

* confirm key connector domain page does not require auth guard

* confirm key connector domain page showing correctly

* key connector url required to be provided when migrating user

* missing locales

* desktop styling

* have to sync and navigate to vault after key connector keys exchange

* logging verbosity

* splitting the web client

* splitting the browser client

* cleanup

* splitting the desktop client

* cleanup

* cleanup

* not necessary if condition

* key connector domain tests fix for sso componrnt and login strategy

* confirm key connector domain base component unit tests coverage

* confirm key connector domain command for cli

* confirm key connector domain command for cli unit tests

* design adjustments

removed repeated text, vertical buttons on desktop, wrong paddings on browser extension

* key connector service unit test coverage

* new linting rules fixes

* accept invitation to organization called twice results in error.

Web vault remembers it's original route destination, which we do not want in case of accepting invitation and Key Connector, since provisioning new user through SSO and Key Connector, the user is already accepted.

* moved required key connector domain confirmation into state

* revert redirect from auth guard

* cleanup

* sso-login.strategy unit test failing

* two-factor-auth.component unit test failing

* two-factor-auth.component unit test coverage

* cli unit test failing

* removal of redundant logs

* removal of un-necessary new lines

* consolidated component

* consolidated component css cleanup

* use KdfConfig type

* consolidate KDF into KdfConfig type in identity token response

* moving KC requiresDomainConfirmation lower in order, after successful auth

* simplification of trySetUserKeyWithMasterKey

* redirect to confirm key connector route when locked but can't unlock yet

---------

Co-authored-by: Todd Martin <tmartin@bitwarden.com>

libs/common/src/auth/models/response/identity-token.response.ts

@@ -2,7 +2,7 @@
 // @ts-strict-ignore
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
-import { KdfType } from "@bitwarden/key-management";
+import { Argon2KdfConfig, KdfConfig, KdfType, PBKDF2KdfConfig } from "@bitwarden/key-management";
 
 import { EncString } from "../../../key-management/crypto/models/enc-string";
 import { BaseResponse } from "../../../models/response/base.response";
@@ -20,10 +20,7 @@ export class IdentityTokenResponse extends BaseResponse {
   privateKey: string; // userKeyEncryptedPrivateKey
   key?: EncString; // masterKeyEncryptedUserKey
   twoFactorToken: string;
-  kdf: KdfType;
-  kdfIterations: number;
-  kdfMemory?: number;
-  kdfParallelism?: number;
+  kdfConfig: KdfConfig;
   forcePasswordReset: boolean;
   masterPasswordPolicy: MasterPasswordPolicyResponse;
   apiUseKeyConnector: boolean;
@@ -45,10 +42,14 @@ export class IdentityTokenResponse extends BaseResponse {
       this.key = new EncString(key);
     }
     this.twoFactorToken = this.getResponseProperty("TwoFactorToken");
-    this.kdf = this.getResponseProperty("Kdf");
-    this.kdfIterations = this.getResponseProperty("KdfIterations");
-    this.kdfMemory = this.getResponseProperty("KdfMemory");
-    this.kdfParallelism = this.getResponseProperty("KdfParallelism");
+    const kdf = this.getResponseProperty("Kdf");
+    const kdfIterations = this.getResponseProperty("KdfIterations");
+    const kdfMemory = this.getResponseProperty("KdfMemory");
+    const kdfParallelism = this.getResponseProperty("KdfParallelism");
+    this.kdfConfig =
+      kdf == KdfType.PBKDF2_SHA256
+        ? new PBKDF2KdfConfig(kdfIterations)
+        : new Argon2KdfConfig(kdfIterations, kdfMemory, kdfParallelism);
     this.forcePasswordReset = this.getResponseProperty("ForcePasswordReset");
     this.apiUseKeyConnector = this.getResponseProperty("ApiUseKeyConnector");
     this.keyConnectorUrl = this.getResponseProperty("KeyConnectorUrl");

libs/common/src/key-management/key-connector/abstractions/key-connector.service.ts

@@ -1,8 +1,10 @@
 import { Observable } from "rxjs";
 
+import { NewSsoUserKeyConnectorConversion } from "@bitwarden/common/key-management/key-connector/models/new-sso-user-key-connector-conversion";
+
 import { Organization } from "../../../admin-console/models/domain/organization";
-import { IdentityTokenResponse } from "../../../auth/models/response/identity-token.response";
 import { UserId } from "../../../types/guid";
+import { KeyConnectorDomainConfirmation } from "../models/key-connector-domain-confirmation";
 
 export abstract class KeyConnectorService {
   abstract setMasterKeyFromUrl(keyConnectorUrl: string, userId: UserId): Promise<void>;
@@ -13,13 +15,18 @@ export abstract class KeyConnectorService {
 
   abstract migrateUser(keyConnectorUrl: string, userId: UserId): Promise<void>;
 
-  abstract convertNewSsoUserToKeyConnector(
-    tokenResponse: IdentityTokenResponse,
-    orgId: string,
-    userId: UserId,
-  ): Promise<void>;
+  abstract convertNewSsoUserToKeyConnector(userId: UserId): Promise<void>;
 
   abstract setUsesKeyConnector(enabled: boolean, userId: UserId): Promise<void>;
 
+  abstract setNewSsoUserKeyConnectorConversionData(
+    conversion: NewSsoUserKeyConnectorConversion,
+    userId: UserId,
+  ): Promise<void>;
+
+  abstract requiresDomainConfirmation$(
+    userId: UserId,
+  ): Observable<KeyConnectorDomainConfirmation | null>;
+
   abstract convertAccountRequired$: Observable<boolean>;
 }

libs/common/src/key-management/key-connector/models/key-connector-domain-confirmation.ts

@@ -0,0 +1,3 @@
+export interface KeyConnectorDomainConfirmation {
+  keyConnectorUrl: string;
+}

libs/common/src/key-management/key-connector/models/new-sso-user-key-connector-conversion.ts

@@ -0,0 +1,9 @@
+// This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
+// eslint-disable-next-line no-restricted-imports
+import { KdfConfig } from "@bitwarden/key-management";
+
+export interface NewSsoUserKeyConnectorConversion {
+  kdfConfig: KdfConfig;
+  keyConnectorUrl: string;
+  organizationId: string;
+}

libs/common/src/key-management/key-connector/services/key-connector.service.spec.ts

@@ -3,16 +3,17 @@ import { firstValueFrom, of, timeout, TimeoutError } from "rxjs";
 
 import { OrganizationService } from "@bitwarden/common/admin-console/abstractions/organization/organization.service.abstraction";
 import { OrganizationUserType } from "@bitwarden/common/admin-console/enums";
+import { SetKeyConnectorKeyRequest } from "@bitwarden/common/key-management/key-connector/models/set-key-connector-key.request";
+import { KeysRequest } from "@bitwarden/common/models/request/keys.request";
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
-import { KdfType, KeyService } from "@bitwarden/key-management";
+import { Argon2KdfConfig, PBKDF2KdfConfig, KeyService, KdfType } from "@bitwarden/key-management";
 
 import { FakeAccountService, FakeStateProvider, mockAccountServiceWith } from "../../../../spec";
 import { ApiService } from "../../../abstractions/api.service";
 import { OrganizationData } from "../../../admin-console/models/data/organization.data";
 import { Organization } from "../../../admin-console/models/domain/organization";
 import { ProfileOrganizationResponse } from "../../../admin-console/models/response/profile-organization.response";
-import { IdentityTokenResponse } from "../../../auth/models/response/identity-token.response";
 import { KeyConnectorUserKeyResponse } from "../../../auth/models/response/key-connector-user-key.response";
 import { TokenService } from "../../../auth/services/token.service";
 import { LogService } from "../../../platform/abstractions/log.service";
@@ -24,8 +25,13 @@ import { KeyGenerationService } from "../../crypto";
 import { EncString } from "../../crypto/models/enc-string";
 import { FakeMasterPasswordService } from "../../master-password/services/fake-master-password.service";
 import { KeyConnectorUserKeyRequest } from "../models/key-connector-user-key.request";
+import { NewSsoUserKeyConnectorConversion } from "../models/new-sso-user-key-connector-conversion";
 
-import { USES_KEY_CONNECTOR, KeyConnectorService } from "./key-connector.service";
+import {
+  USES_KEY_CONNECTOR,
+  NEW_SSO_USER_KEY_CONNECTOR_CONVERSION,
+  KeyConnectorService,
+} from "./key-connector.service";
 
 describe("KeyConnectorService", () => {
   let keyConnectorService: KeyConnectorService;
@@ -36,6 +42,7 @@ describe("KeyConnectorService", () => {
   const logService = mock<LogService>();
   const organizationService = mock<OrganizationService>();
   const keyGenerationService = mock<KeyGenerationService>();
+  const logoutCallback = jest.fn();
 
   let stateProvider: FakeStateProvider;
 
@@ -51,6 +58,12 @@ describe("KeyConnectorService", () => {
 
   const keyConnectorUrl = "https://key-connector-url.com";
 
+  const conversion: NewSsoUserKeyConnectorConversion = {
+    kdfConfig: new PBKDF2KdfConfig(600_000),
+    keyConnectorUrl,
+    organizationId: mockOrgId,
+  };
+
   beforeEach(() => {
     jest.resetAllMocks();
 
@@ -67,7 +80,7 @@ describe("KeyConnectorService", () => {
       logService,
       organizationService,
       keyGenerationService,
-      async () => {},
+      logoutCallback,
       stateProvider,
     );
   });
@@ -406,28 +419,21 @@ describe("KeyConnectorService", () => {
   });
 
   describe("convertNewSsoUserToKeyConnector", () => {
-    const tokenResponse = mock<IdentityTokenResponse>();
     const passwordKey = new SymmetricCryptoKey(new Uint8Array(64));
     const mockUserKey = new SymmetricCryptoKey(new Uint8Array(64)) as UserKey;
     const mockEmail = "test@example.com";
     const mockMasterKey = getMockMasterKey();
+    const mockKeyPair = ["mockPubKey", new EncString("mockEncryptedPrivKey")] as [
+      string,
+      EncString,
+    ];
     let mockMakeUserKeyResult: [UserKey, EncString];
 
     beforeEach(() => {
       const mockUserKey = new SymmetricCryptoKey(new Uint8Array(64)) as UserKey;
-      const mockKeyPair = ["mockPubKey", new EncString("mockEncryptedPrivKey")] as [
-        string,
-        EncString,
-      ];
       const encString = new EncString("mockEncryptedString");
       mockMakeUserKeyResult = [mockUserKey, encString] as [UserKey, EncString];
 
-      tokenResponse.kdf = KdfType.PBKDF2_SHA256;
-      tokenResponse.kdfIterations = 100000;
-      tokenResponse.kdfMemory = 16;
-      tokenResponse.kdfParallelism = 4;
-      tokenResponse.keyConnectorUrl = keyConnectorUrl;
-
       keyGenerationService.createKey.mockResolvedValue(passwordKey);
       keyService.makeMasterKey.mockResolvedValue(mockMasterKey);
       keyService.makeUserKey.mockResolvedValue(mockMakeUserKeyResult);
@@ -435,56 +441,85 @@ describe("KeyConnectorService", () => {
       tokenService.getEmail.mockResolvedValue(mockEmail);
     });
 
-    it("sets up a new SSO user with key connector", async () => {
-      await keyConnectorService.convertNewSsoUserToKeyConnector(
-        tokenResponse,
-        mockOrgId,
-        mockUserId,
-      );
+    it.each([
+      [KdfType.PBKDF2_SHA256, 700_000, undefined, undefined],
+      [KdfType.Argon2id, 11, 65, 5],
+    ])(
+      "sets up a new SSO user with key connector",
+      async (kdfType, kdfIterations, kdfMemory, kdfParallelism) => {
+        const expectedKdfConfig =
+          kdfType == KdfType.PBKDF2_SHA256
+            ? new PBKDF2KdfConfig(kdfIterations)
+            : new Argon2KdfConfig(kdfIterations, kdfMemory, kdfParallelism);
 
-      expect(keyGenerationService.createKey).toHaveBeenCalledWith(512);
-      expect(keyService.makeMasterKey).toHaveBeenCalledWith(
-        passwordKey.keyB64,
-        mockEmail,
-        expect.any(Object),
-      );
-      expect(masterPasswordService.mock.setMasterKey).toHaveBeenCalledWith(
-        mockMasterKey,
-        mockUserId,
-      );
-      expect(keyService.makeUserKey).toHaveBeenCalledWith(mockMasterKey);
-      expect(keyService.setUserKey).toHaveBeenCalledWith(mockUserKey, mockUserId);
-      expect(masterPasswordService.mock.setMasterKeyEncryptedUserKey).toHaveBeenCalledWith(
-        mockMakeUserKeyResult[1],
-        mockUserId,
-      );
-      expect(keyService.makeKeyPair).toHaveBeenCalledWith(mockMakeUserKeyResult[0]);
-      expect(apiService.postUserKeyToKeyConnector).toHaveBeenCalledWith(
-        tokenResponse.keyConnectorUrl,
-        expect.any(KeyConnectorUserKeyRequest),
-      );
-      expect(apiService.postSetKeyConnectorKey).toHaveBeenCalled();
-    });
+        const conversion: NewSsoUserKeyConnectorConversion = {
+          kdfConfig: expectedKdfConfig,
+          keyConnectorUrl: keyConnectorUrl,
+          organizationId: mockOrgId,
+        };
+        const conversionState = stateProvider.singleUser.getFake(
+          mockUserId,
+          NEW_SSO_USER_KEY_CONNECTOR_CONVERSION,
+        );
+        conversionState.nextState(conversion);
+
+        await keyConnectorService.convertNewSsoUserToKeyConnector(mockUserId);
+
+        expect(keyGenerationService.createKey).toHaveBeenCalledWith(512);
+        expect(keyService.makeMasterKey).toHaveBeenCalledWith(
+          passwordKey.keyB64,
+          mockEmail,
+          expectedKdfConfig,
+        );
+        expect(masterPasswordService.mock.setMasterKey).toHaveBeenCalledWith(
+          mockMasterKey,
+          mockUserId,
+        );
+        expect(keyService.makeUserKey).toHaveBeenCalledWith(mockMasterKey);
+        expect(keyService.setUserKey).toHaveBeenCalledWith(mockUserKey, mockUserId);
+        expect(masterPasswordService.mock.setMasterKeyEncryptedUserKey).toHaveBeenCalledWith(
+          mockMakeUserKeyResult[1],
+          mockUserId,
+        );
+        expect(keyService.makeKeyPair).toHaveBeenCalledWith(mockMakeUserKeyResult[0]);
+        expect(apiService.postUserKeyToKeyConnector).toHaveBeenCalledWith(
+          keyConnectorUrl,
+          new KeyConnectorUserKeyRequest(
+            Utils.fromBufferToB64(mockMasterKey.inner().encryptionKey),
+          ),
+        );
+        expect(apiService.postSetKeyConnectorKey).toHaveBeenCalledWith(
+          new SetKeyConnectorKeyRequest(
+            mockMakeUserKeyResult[1].encryptedString!,
+            expectedKdfConfig,
+            mockOrgId,
+            new KeysRequest(mockKeyPair[0], mockKeyPair[1].encryptedString!),
+          ),
+        );
+
+        // Verify that conversion data is cleared from conversionState
+        expect(await firstValueFrom(conversionState.state$)).toBeNull();
+      },
+    );
 
     it("handles api error", async () => {
       apiService.postUserKeyToKeyConnector.mockRejectedValue(new Error("API error"));
 
-      try {
-        await keyConnectorService.convertNewSsoUserToKeyConnector(
-          tokenResponse,
-          mockOrgId,
-          mockUserId,
-        );
-      } catch (error: any) {
-        expect(error).toBeInstanceOf(Error);
-        expect(error?.message).toBe("Key Connector error");
-      }
+      const conversionState = stateProvider.singleUser.getFake(
+        mockUserId,
+        NEW_SSO_USER_KEY_CONNECTOR_CONVERSION,
+      );
+      conversionState.nextState(conversion);
+
+      await expect(keyConnectorService.convertNewSsoUserToKeyConnector(mockUserId)).rejects.toThrow(
+        new Error("Key Connector error"),
+      );
 
       expect(keyGenerationService.createKey).toHaveBeenCalledWith(512);
       expect(keyService.makeMasterKey).toHaveBeenCalledWith(
         passwordKey.keyB64,
         mockEmail,
-        expect.any(Object),
+        new PBKDF2KdfConfig(600_000),
       );
       expect(masterPasswordService.mock.setMasterKey).toHaveBeenCalledWith(
         mockMasterKey,
@@ -498,10 +533,90 @@ describe("KeyConnectorService", () => {
       );
       expect(keyService.makeKeyPair).toHaveBeenCalledWith(mockMakeUserKeyResult[0]);
       expect(apiService.postUserKeyToKeyConnector).toHaveBeenCalledWith(
-        tokenResponse.keyConnectorUrl,
-        expect.any(KeyConnectorUserKeyRequest),
+        keyConnectorUrl,
+        new KeyConnectorUserKeyRequest(Utils.fromBufferToB64(mockMasterKey.inner().encryptionKey)),
       );
       expect(apiService.postSetKeyConnectorKey).not.toHaveBeenCalled();
+      expect(await firstValueFrom(conversionState.state$)).toEqual(conversion);
+
+      expect(logoutCallback).toHaveBeenCalledWith("keyConnectorError");
+    });
+
+    it("should throw error when conversion data is null", async () => {
+      const conversionState = stateProvider.singleUser.getFake(
+        mockUserId,
+        NEW_SSO_USER_KEY_CONNECTOR_CONVERSION,
+      );
+      conversionState.nextState(null);
+
+      await expect(keyConnectorService.convertNewSsoUserToKeyConnector(mockUserId)).rejects.toThrow(
+        new Error("Key Connector conversion not found"),
+      );
+
+      // Verify that no key generation or API calls were made
+      expect(keyGenerationService.createKey).not.toHaveBeenCalled();
+      expect(keyService.makeMasterKey).not.toHaveBeenCalled();
+      expect(apiService.postUserKeyToKeyConnector).not.toHaveBeenCalled();
+      expect(apiService.postSetKeyConnectorKey).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("setNewSsoUserKeyConnectorConversionData", () => {
+    it("should store Key Connector domain confirmation data in state", async () => {
+      const state = stateProvider.singleUser.getFake(
+        mockUserId,
+        NEW_SSO_USER_KEY_CONNECTOR_CONVERSION,
+      );
+      state.nextState(null);
+
+      await keyConnectorService.setNewSsoUserKeyConnectorConversionData(conversion, mockUserId);
+
+      expect(await firstValueFrom(state.state$)).toEqual(conversion);
+    });
+
+    it("should overwrite existing Key Connector domain confirmation data", async () => {
+      const state = stateProvider.singleUser.getFake(
+        mockUserId,
+        NEW_SSO_USER_KEY_CONNECTOR_CONVERSION,
+      );
+      const existingConversion: NewSsoUserKeyConnectorConversion = {
+        kdfConfig: new Argon2KdfConfig(3, 64, 4),
+        keyConnectorUrl: "https://old.example.com",
+        organizationId: "old-org-id" as OrganizationId,
+      };
+      state.nextState(existingConversion);
+
+      await keyConnectorService.setNewSsoUserKeyConnectorConversionData(conversion, mockUserId);
+
+      expect(await firstValueFrom(state.state$)).toEqual(conversion);
+    });
+  });
+
+  describe("requiresDomainConfirmation$", () => {
+    it("should return observable of key connector domain confirmation value when set", async () => {
+      const state = stateProvider.singleUser.getFake(
+        mockUserId,
+        NEW_SSO_USER_KEY_CONNECTOR_CONVERSION,
+      );
+      state.nextState(conversion);
+
+      const data$ = keyConnectorService.requiresDomainConfirmation$(mockUserId);
+      const data = await firstValueFrom(data$);
+
+      expect(data).toEqual({ keyConnectorUrl: conversion.keyConnectorUrl });
+    });
+
+    it("should return observable of null value when no data is set", async () => {
+      const state = stateProvider.singleUser.getFake(
+        mockUserId,
+        NEW_SSO_USER_KEY_CONNECTOR_CONVERSION,
+      );
+      state.nextState(null);
+
+      const data$ = keyConnectorService.requiresDomainConfirmation$(mockUserId);
+      const data = await firstValueFrom(data$);
+
+      expect(data).toBeNull();
     });
   });
 

libs/common/src/key-management/key-connector/services/key-connector.service.ts

@@ -1,27 +1,21 @@
 // FIXME: Update this file to be type safe and remove this and next line
 // @ts-strict-ignore
-import { combineLatest, filter, firstValueFrom, Observable, of, switchMap } from "rxjs";
+import { combineLatest, filter, firstValueFrom, map, Observable, of, switchMap } from "rxjs";
 
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
 import { LogoutReason } from "@bitwarden/auth/common";
 import { AccountService } from "@bitwarden/common/auth/abstractions/account.service";
+import { NewSsoUserKeyConnectorConversion } from "@bitwarden/common/key-management/key-connector/models/new-sso-user-key-connector-conversion";
 // This import has been flagged as unallowed for this class. It may be involved in a circular dependency loop.
 // eslint-disable-next-line no-restricted-imports
-import {
-  Argon2KdfConfig,
-  KdfConfig,
-  PBKDF2KdfConfig,
-  KeyService,
-  KdfType,
-} from "@bitwarden/key-management";
+import { Argon2KdfConfig, KdfType, KeyService, PBKDF2KdfConfig } from "@bitwarden/key-management";
 
 import { ApiService } from "../../../abstractions/api.service";
 import { OrganizationService } from "../../../admin-console/abstractions/organization/organization.service.abstraction";
 import { OrganizationUserType } from "../../../admin-console/enums";
 import { Organization } from "../../../admin-console/models/domain/organization";
 import { TokenService } from "../../../auth/abstractions/token.service";
-import { IdentityTokenResponse } from "../../../auth/models/response/identity-token.response";
 import { KeysRequest } from "../../../models/request/keys.request";
 import { LogService } from "../../../platform/abstractions/log.service";
 import { Utils } from "../../../platform/misc/utils";
@@ -32,6 +26,7 @@ import { MasterKey } from "../../../types/key";
 import { KeyGenerationService } from "../../crypto";
 import { InternalMasterPasswordServiceAbstraction } from "../../master-password/abstractions/master-password.service.abstraction";
 import { KeyConnectorService as KeyConnectorServiceAbstraction } from "../abstractions/key-connector.service";
+import { KeyConnectorDomainConfirmation } from "../models/key-connector-domain-confirmation";
 import { KeyConnectorUserKeyRequest } from "../models/key-connector-user-key.request";
 import { SetKeyConnectorKeyRequest } from "../models/set-key-connector-key.request";
 
@@ -45,6 +40,27 @@ export const USES_KEY_CONNECTOR = new UserKeyDefinition<boolean | null>(
   },
 );
 
+export const NEW_SSO_USER_KEY_CONNECTOR_CONVERSION =
+  new UserKeyDefinition<NewSsoUserKeyConnectorConversion | null>(
+    KEY_CONNECTOR_DISK,
+    "newSsoUserKeyConnectorConversion",
+    {
+      deserializer: (conversion) =>
+        conversion == null
+          ? null
+          : {
+              kdfConfig:
+                conversion.kdfConfig.kdfType === KdfType.PBKDF2_SHA256
+                  ? PBKDF2KdfConfig.fromJSON(conversion.kdfConfig)
+                  : Argon2KdfConfig.fromJSON(conversion.kdfConfig),
+              keyConnectorUrl: conversion.keyConnectorUrl,
+              organizationId: conversion.organizationId,
+            },
+      clearOn: ["logout"],
+      cleanupDelayMs: 0,
+    },
+  );
+
 export class KeyConnectorService implements KeyConnectorServiceAbstraction {
   readonly convertAccountRequired$: Observable<boolean>;
 
@@ -128,25 +144,17 @@ export class KeyConnectorService implements KeyConnectorServiceAbstraction {
     return this.findManagingOrganization(organizations);
   }
 
-  async convertNewSsoUserToKeyConnector(
-    tokenResponse: IdentityTokenResponse,
-    orgId: string,
-    userId: UserId,
-  ) {
-    // TODO: Remove after tokenResponse.keyConnectorUrl is deprecated in 2023.10 release (https://bitwarden.atlassian.net/browse/PM-3537)
-    const {
-      kdf,
-      kdfIterations,
-      kdfMemory,
-      kdfParallelism,
-      keyConnectorUrl: legacyKeyConnectorUrl,
-      userDecryptionOptions,
-    } = tokenResponse;
+  async convertNewSsoUserToKeyConnector(userId: UserId) {
+    const conversion = await firstValueFrom(
+      this.stateProvider.getUserState$(NEW_SSO_USER_KEY_CONNECTOR_CONVERSION, userId),
+    );
+    if (conversion == null) {
+      throw new Error("Key Connector conversion not found");
+    }
+
+    const { kdfConfig, keyConnectorUrl, organizationId } = conversion;
+
     const password = await this.keyGenerationService.createKey(512);
-    const kdfConfig: KdfConfig =
-      kdf === KdfType.PBKDF2_SHA256
-        ? new PBKDF2KdfConfig(kdfIterations)
-        : new Argon2KdfConfig(kdfIterations, kdfMemory, kdfParallelism);
 
     const masterKey = await this.keyService.makeMasterKey(
       password.keyB64,
@@ -165,8 +173,6 @@ export class KeyConnectorService implements KeyConnectorServiceAbstraction {
     const [pubKey, privKey] = await this.keyService.makeKeyPair(userKey[0]);
 
     try {
-      const keyConnectorUrl =
-        legacyKeyConnectorUrl ?? userDecryptionOptions?.keyConnectorOption?.keyConnectorUrl;
       await this.apiService.postUserKeyToKeyConnector(keyConnectorUrl, keyConnectorRequest);
     } catch (e) {
       this.handleKeyConnectorError(e);
@@ -176,10 +182,29 @@ export class KeyConnectorService implements KeyConnectorServiceAbstraction {
     const setPasswordRequest = new SetKeyConnectorKeyRequest(
       userKey[1].encryptedString,
       kdfConfig,
-      orgId,
+      organizationId,
       keys,
     );
     await this.apiService.postSetKeyConnectorKey(setPasswordRequest);
+
+    await this.stateProvider
+      .getUser(userId, NEW_SSO_USER_KEY_CONNECTOR_CONVERSION)
+      .update(() => null);
+  }
+
+  async setNewSsoUserKeyConnectorConversionData(
+    conversion: NewSsoUserKeyConnectorConversion,
+    userId: UserId,
+  ): Promise<void> {
+    await this.stateProvider
+      .getUser(userId, NEW_SSO_USER_KEY_CONNECTOR_CONVERSION)
+      .update(() => conversion);
+  }
+
+  requiresDomainConfirmation$(userId: UserId): Observable<KeyConnectorDomainConfirmation | null> {
+    return this.stateProvider
+      .getUserState$(NEW_SSO_USER_KEY_CONNECTOR_CONVERSION, userId)
+      .pipe(map((data) => (data != null ? { keyConnectorUrl: data.keyConnectorUrl } : null)));
   }
 
   private handleKeyConnectorError(e: any) {