diff --git a/bitwarden_license/src/Sso/Controllers/AccountController.cs b/bitwarden_license/src/Sso/Controllers/AccountController.cs
index 30b0d168d0..98a581e8ca 100644
--- a/bitwarden_license/src/Sso/Controllers/AccountController.cs
+++ b/bitwarden_license/src/Sso/Controllers/AccountController.cs
@@ -108,36 +108,32 @@ public class AccountController : Controller
// Validate domain_hint provided
if (string.IsNullOrWhiteSpace(domainHint))
{
- return InvalidJson("NoOrganizationIdentifierProvidedError");
+ _logger.LogError(new ArgumentException("domainHint is required."), "domainHint not specified.");
+ return InvalidJson("SsoInvalidIdentifierError");
}
// Validate organization exists from domain_hint
var organization = await _organizationRepository.GetByIdentifierAsync(domainHint);
- if (organization == null)
+ if (organization is not { UseSso: true })
{
- return InvalidJson("OrganizationNotFoundByIdentifierError");
- }
- if (!organization.UseSso)
- {
- return InvalidJson("SsoNotAllowedForOrganizationError");
+ _logger.LogError("Organization not configured to use SSO.");
+ return InvalidJson("SsoInvalidIdentifierError");
}
// Validate SsoConfig exists and is Enabled
var ssoConfig = await _ssoConfigRepository.GetByIdentifierAsync(domainHint);
- if (ssoConfig == null)
+ if (ssoConfig is not { Enabled: true })
{
- return InvalidJson("SsoConfigurationNotFoundForOrganizationError");
- }
- if (!ssoConfig.Enabled)
- {
- return InvalidJson("SsoNotEnabledForOrganizationError");
+ _logger.LogError("SsoConfig not enabled.");
+ return InvalidJson("SsoInvalidIdentifierError");
}
// Validate Authentication Scheme exists and is loaded (cache)
var scheme = await _schemeProvider.GetSchemeAsync(organization.Id.ToString());
- if (scheme == null || !(scheme is IDynamicAuthenticationScheme dynamicScheme))
+ if (scheme is not IDynamicAuthenticationScheme dynamicScheme)
{
- return InvalidJson("NoSchemeOrHandlerForSsoConfigurationFoundError");
+ _logger.LogError("Invalid authentication scheme for organization.");
+ return InvalidJson("SsoInvalidIdentifierError");
}
// Run scheme validation
@@ -147,13 +143,8 @@ public class AccountController : Controller
}
catch (Exception ex)
{
- var translatedException = _i18nService.GetLocalizedHtmlString(ex.Message);
- var errorKey = "InvalidSchemeConfigurationError";
- if (!translatedException.ResourceNotFound)
- {
- errorKey = ex.Message;
- }
- return InvalidJson(errorKey, translatedException.ResourceNotFound ? ex : null);
+ _logger.LogError(ex, "An error occurred while validating SSO dynamic scheme.");
+ return InvalidJson("SsoInvalidIdentifierError");
}
var tokenable = new SsoTokenable(organization, _globalSettings.Sso.SsoTokenLifetimeInSeconds);
@@ -163,7 +154,8 @@ public class AccountController : Controller
}
catch (Exception ex)
{
- return InvalidJson("PreValidationError", ex);
+ _logger.LogError(ex, "An error occurred during SSO prevalidation.");
+ return InvalidJson("SsoInvalidIdentifierError");
}
}
@@ -352,7 +344,7 @@ public class AccountController : Controller
}
///
- /// Attempts to map the external identity to a Bitwarden user, through the SsoUser table, which holds the `externalId`.
+ /// Attempts to map the external identity to a Bitwarden user, through the SsoUser table, which holds the `externalId`.
/// The claims on the external identity are used to determine an `externalId`, and that is used to find the appropriate `SsoUser` and `User` records.
///
private async Task<(User user, string provider, string providerUserId, IEnumerable claims, SsoConfigurationData config)>
@@ -485,7 +477,7 @@ public class AccountController : Controller
allowedStatuses: [OrganizationUserStatusType.Accepted, OrganizationUserStatusType.Confirmed]);
- // Since we're in the auto-provisioning logic, this means that the user exists, but they have not
+ // Since we're in the auto-provisioning logic, this means that the user exists, but they have not
// authenticated with the org's SSO provider before now (otherwise we wouldn't be auto-provisioning them).
// We've verified that the user is Accepted or Confnirmed, so we can create an SsoUser link and proceed
// with authentication.
diff --git a/src/Core/Resources/SharedResources.en.resx b/src/Core/Resources/SharedResources.en.resx
index 97cac5a610..17b4489454 100644
--- a/src/Core/Resources/SharedResources.en.resx
+++ b/src/Core/Resources/SharedResources.en.resx
@@ -394,24 +394,9 @@
The configured authentication scheme is not valid: "{0}"
-
- No scheme or handler for this SSO configuration found.
-
-
- SSO is not yet enabled for this organization.
-
-
- No SSO configuration exists for this organization.
-
-
- SSO is not allowed for this organization.
-
Organization not found from identifier.
-
- No organization identifier provided.
-
Invalid authentication options provided to SAML2 scheme.
@@ -691,4 +676,7 @@
Single sign on redirect token is invalid or expired.
+
+ Invalid SSO identifier
+