SSO: Request to user_info endpoint failed: Server returned invalid response: unexpected HTTP status code #125

New Issue

MrUnknownDE · 2026-04-05T20:31:07+02:00

MrUnknownDE commented

2026-04-05 20:31:07 +02:00

Originally created by @ChimpGamer on 2/8/2026

Prerequisites

I have searched the existing Closed AND Open Issues AND Discussions - (There is a discussion about this from last year but without any response)
I have searched and read the documentation

Vaultwarden Support String

Your environment (Generated via diagnostics page)

Vaultwarden version: v1.35.2
Web-vault version: v2025.12.1+build.3
OS/Arch: linux/x86_64
Running within a container: true (Base: Debian)
Database type: SQLite
Database version: 3.50.2
Uses config.json: true
Uses a reverse proxy: true
IP Header check: true (X-Real-IP)
Internet access: true
Internet access via a proxy: false
DNS Check: true
Browser/Server Time Check: true
Server/NTP Time Check: true
Domain Configuration Check: true
HTTPS Check: true
Websocket Check: true
HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN, SSO_ENABLED, SSO_ONLY, SSO_CLIENT_ID, SSO_CLIENT_SECRET, SSO_AUTHORITY

Config:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": false,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_idle_timeout": 600,
  "database_max_conns": 10,
  "database_min_conns": 2,
  "database_timeout": 30,
  "database_url": "***************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "dns_prefer_ipv6": false,
  "domain": "*****://****************",
  "domain_origin": "*****://****************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "debug",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "purge_incomplete_sso_auth": "0 20 0 * * *",
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": true,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "",
  "smtp_from_name": "***********",
  "smtp_host": null,
  "smtp_password": null,
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": null,
  "sso_allow_unknown_email_verification": false,
  "sso_audience_trusted": null,
  "sso_auth_only_not_session": false,
  "sso_authority": "*****://***********************",
  "sso_authorize_extra_params": "",
  "sso_callback_path": "*****://*********************************************",
  "sso_client_cache_expiration": 0,
  "sso_client_id": "************************************",
  "sso_client_secret": "***",
  "sso_debug_tokens": false,
  "sso_enabled": true,
  "sso_master_password_policy": null,
  "sso_only": false,
  "sso_pkce": true,
  "sso_scopes": "openid email profile",
  "sso_signups_match_email": true,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

1.35.2

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

openresty 1.27.1.2

Host/Server Operating System

Linux

Operating System Version

Photon OS 5.0

Clients

Web Vault

Client Version

Edge 144.0.3719.115

Steps To Reproduce

Go to https://vaultwarden/#/login
Enter Email address
Click on 'Use single sign-on'

Expected Result

I'm not sure if ADFS is supported but I expected it to. I'm not sure if this is a bug, configuration issue or simply ADFS being unsupported as SSO server.

Actual Result

I get a browser popup saying "Request to user_info endpoint failed: Server returned invalid response: unexpected HTTP status code"

In the console of docker with debug mode enabled I see:

[2026-02-08 15:22:33.390][vaultwarden::sso_client][ERROR] Request to user_info endpoint failed: Server returned invalid response: unexpected HTTP status code
[2026-02-08 15:22:33.390][response][INFO] (login) POST /identity/connect/token => 400 Bad Request

It does not allow me to login with SSO.

Logs

[2026-02-08 15:22:33.343][request][INFO] POST /identity/connect/token
[2026-02-08 15:22:33.371][reqwest::connect][DEBUG] starting new connection: https://adfs.example.local/
[2026-02-08 15:22:33.373][hyper_util::client::legacy::connect::http][DEBUG] connecting to xxx.xxx.xxx.xxx:443
[2026-02-08 15:22:33.373][hyper_util::client::legacy::connect::http][DEBUG] connected to xxx.xxx.xxx.xxx:443
[2026-02-08 15:22:33.379][hyper_util::client::legacy::pool][DEBUG] pooling idle connection for ("https", adfs.example.local)
[2026-02-08 15:22:33.379][hyper_util::client::legacy::pool][DEBUG] reuse idle connection for ("https", adfs.example.local)
[2026-02-08 15:22:33.380][hyper_util::client::legacy::pool][DEBUG] pooling idle connection for ("https", adfs.example.local)
[2026-02-08 15:22:33.380][hyper_util::client::legacy::pool][DEBUG] reuse idle connection for ("https", adfs.example.local)
[2026-02-08 15:22:33.387][hyper_util::client::legacy::pool][DEBUG] pooling idle connection for ("https", adfs.example.local)
[2026-02-08 15:22:33.388][hyper_util::client::legacy::pool][DEBUG] reuse idle connection for ("https", adfs.example.local)
[2026-02-08 15:22:33.390][hyper_util::client::legacy::pool][DEBUG] pooling idle connection for ("https", adfs.example.local)
[2026-02-08 15:22:33.390][vaultwarden::sso_client][ERROR] Request to user_info endpoint failed: Server returned invalid response: unexpected HTTP status code
[2026-02-08 15:22:33.390][response][INFO] (login) POST /identity/connect/token => 400 Bad Request

Screenshots or Videos

Additional Context

No response

*Originally created by @ChimpGamer on 2/8/2026* ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - (There is a discussion about this from last year but without any response) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.35.2 * Web-vault version: v2025.12.1+build.3 * OS/Arch: linux/x86_64 * Running within a container: true (Base: Debian) * Database type: SQLite * Database version: 3.50.2 * Uses config.json: true * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: true * HTTPS Check: true * Websocket Check: true * HTTP Response Checks: true ### Config & Details (Generated via diagnostics page) <details><summary>Show Config & Details</summary> **Environment settings which are overridden:** DOMAIN, SIGNUPS_ALLOWED, ADMIN_TOKEN, SSO_ENABLED, SSO_ONLY, SSO_CLIENT_ID, SSO_CLIENT_SECRET, SSO_AUTHORITY **Config:** ```json { "_duo_akey": null, "_enable_duo": true, "_enable_email_2fa": false, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_idle_timeout": 600, "database_max_conns": 10, "database_min_conns": 2, "database_timeout": 30, "database_url": "***************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "dns_prefer_ipv6": false, "domain": "*****://****************", "domain_origin": "*****://****************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "debug", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 600000, "purge_incomplete_sso_auth": "0 20 0 * * *", "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": true, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "", "smtp_from_name": "***********", "smtp_host": null, "smtp_password": null, "smtp_port": 587, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": null, "sso_allow_unknown_email_verification": false, "sso_audience_trusted": null, "sso_auth_only_not_session": false, "sso_authority": "*****://***********************", "sso_authorize_extra_params": "", "sso_callback_path": "*****://*********************************************", "sso_client_cache_expiration": 0, "sso_client_id": "************************************", "sso_client_secret": "***", "sso_debug_tokens": false, "sso_enabled": true, "sso_master_password_policy": null, "sso_only": false, "sso_pkce": true, "sso_scopes": "openid email profile", "sso_signups_match_email": true, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details> ### Vaultwarden Build Version 1.35.2 ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy openresty 1.27.1.2 ### Host/Server Operating System Linux ### Operating System Version Photon OS 5.0 ### Clients Web Vault ### Client Version Edge 144.0.3719.115 ### Steps To Reproduce 1. Go to https://vaultwarden/#/login 2. Enter Email address 3. Click on 'Use single sign-on' ### Expected Result I'm not sure if ADFS is supported but I expected it to. I'm not sure if this is a bug, configuration issue or simply ADFS being unsupported as SSO server. ### Actual Result I get a browser popup saying "Request to user_info endpoint failed: Server returned invalid response: unexpected HTTP status code" In the console of docker with debug mode enabled I see: ``` [2026-02-08 15:22:33.390][vaultwarden::sso_client][ERROR] Request to user_info endpoint failed: Server returned invalid response: unexpected HTTP status code [2026-02-08 15:22:33.390][response][INFO] (login) POST /identity/connect/token => 400 Bad Request ``` It does not allow me to login with SSO. ### Logs ```text [2026-02-08 15:22:33.343][request][INFO] POST /identity/connect/token [2026-02-08 15:22:33.371][reqwest::connect][DEBUG] starting new connection: https://adfs.example.local/ [2026-02-08 15:22:33.373][hyper_util::client::legacy::connect::http][DEBUG] connecting to xxx.xxx.xxx.xxx:443 [2026-02-08 15:22:33.373][hyper_util::client::legacy::connect::http][DEBUG] connected to xxx.xxx.xxx.xxx:443 [2026-02-08 15:22:33.379][hyper_util::client::legacy::pool][DEBUG] pooling idle connection for ("https", adfs.example.local) [2026-02-08 15:22:33.379][hyper_util::client::legacy::pool][DEBUG] reuse idle connection for ("https", adfs.example.local) [2026-02-08 15:22:33.380][hyper_util::client::legacy::pool][DEBUG] pooling idle connection for ("https", adfs.example.local) [2026-02-08 15:22:33.380][hyper_util::client::legacy::pool][DEBUG] reuse idle connection for ("https", adfs.example.local) [2026-02-08 15:22:33.387][hyper_util::client::legacy::pool][DEBUG] pooling idle connection for ("https", adfs.example.local) [2026-02-08 15:22:33.388][hyper_util::client::legacy::pool][DEBUG] reuse idle connection for ("https", adfs.example.local) [2026-02-08 15:22:33.390][hyper_util::client::legacy::pool][DEBUG] pooling idle connection for ("https", adfs.example.local) [2026-02-08 15:22:33.390][vaultwarden::sso_client][ERROR] Request to user_info endpoint failed: Server returned invalid response: unexpected HTTP status code [2026-02-08 15:22:33.390][response][INFO] (login) POST /identity/connect/token => 400 Bad Request ``` ### Screenshots or Videos <img width="1001" height="947" alt="Image" src="https://github.com/user-attachments/assets/86ef5533-584f-43cb-8394-f5cb594f5adb" /> ### Additional Context _No response_

MrUnknownDE closed this issue

2026-04-05 20:31:07 +02:00

MrUnknownDE added the bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug bug labels 2026-04-05 20:31:12 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#125