Default organization flow for SSO_ONLY

[axellpadilla]

I would like to discuss an opt-in flow for SSO_ONLY=true where SSO users can be automatically invited or provisioned into a pre-existing default organization.

Current behavior

Today, SSO authentication works, but organization membership is still separate and manual.

In practice, the flow is:

1. Create a local Vaultwarden user first
2. Use that user to create the first organization
3. Invite the first SSO user by email
4. Accept/confirm the invite
5. Repeat invites for future SSO users

References:

• The SSO wiki documents account association and invited stub accounts, but not default org auto-join:
  https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect
• Discussion How can I set up all SSO users to automatically be members? #6192 explicitly states that auto-joining organizations is not supported:
  How can I set up all SSO users to automatically be members? #6192
• Issue SSO: "Failed to retrieve the associated organization" #6374 shows related onboarding friction around SSO and associated organizations:
  SSO: "Failed to retrieve the associated organization" #6374

Code context

From the current codebase:

• create_organization() creates the organization, the creator membership, and the initial collection, but does not provide any default-org SSO behavior:
  • src/api/core/organizations.rs
• The current SSO flow already has a dedicated auto-enroll path and a dummy identifier:
  • GET /organizations/<identifier>/auto-enroll-status
  • vaultwarden-dummy-oidc-identifier
  • src/api/core/organizations.rs
  • src/sso.rs

Proposal

Add an opt-in configuration for a pre-created default organization when SSO_ONLY=true.

For example:

• SSO_DEFAULT_ORG_NAME=<name> or similar

Expected behavior:

• If SSO login succeeds
• and the user is not yet a member of the configured default org
• on first successful SSO login, if user is not already in that org, create membership as: User, access_all=false
• Vaultwarden should automatically create the org membership (or invitation flow equivalent) for that org

This would remove the current requirement to bootstrap with a local user just to manually invite every SSO user.

Prior art

OIDCWarden appears to already implement related features:

• organization auto-invitation
• organization membership role sync
• organization membership revocation

Relevant commits include:

• cff6c2b3 — base SSO + organization enrollment handling
• 14de1e71 — allow group/organization mapping to trigger invitation
• 1497dded — organization role support
• 0c006894 — organization/group sync rework
• 74819b95 — SSO_ONLY invite-flow fix

It still requires the organization to be created first.

Reference:
https://github.com/Timshel/OIDCWarden

Possible implementation direction

A minimal first step could be:

1. Keep manual org creation the same
2. add a config-backed “default org” for SSO, only this default can be used for automated future logins
3. reuse the existing organization membership/invitation code paths
4. integrate it into the existing SSO auto-enroll flow instead of the dummy-only path

Scope boundary

This proposal is intentionally narrow:

• it only targets automatic membership bootstrap for a single pre-existing organization
• it does not auto-create more organizations
• it does not attempt full group/org synchronization
• it does not implement Bitwarden commercial modules

The goal is to reduce the current SSO_ONLY bootstrap friction while keeping the scope small and clearly separated from broader commercial-module functionality.

[darkymehdi]

same problem here, I can't reach the password creation screen for my new sso users because of "The current user isn't member of the organization"

[BlackDex]

Already fixed in :testing

[darkymehdi]

thanks !

[axellpadilla]

Mmmm tried it but didnt work, users are still not automatically part of the org

[Gabgobie]

For example:

• SSO_DEFAULT_ORG_NAME=<name> or similar

I'd rather take the organization(s) to join from an OIDC claim.

SSO_ORGANIZATIONS_CLAIM=<name> (claim to be configured as array of strings)

That would allow for better segmentation of credentials and who gets to access them.

That does not quite align with your first scoping constraint as it may assign any number of pre-existing organizations. I would still think that it is reasonable to implement.

it only targets automatic membership bootstrap for a single pre-existing organization

[tom27052006]

I’ve implemented this in #7422. The approach uses a SSO_DEFAULT_ORG config variable: on first successful SSO login, if the user isn’t already a member of the configured default organization, they get automatically enrolled as a regular User. It reuses the existing organization membership/invitation code paths and integrates into the current SSO auto-enroll flow, matching the narrow scope outlined here — a single pre-existing org, no auto-creation of new orgs, no full group/org sync.

#7422

Now it’s up to the maintainers to weigh in and see what they think of the approach