Bitwarden + Google SAML

[Not_Honest (Pavel Lubyanskiy)]

Hello!
I am trying to set up SSO login via Google SAML. I followed these instructions:

SAML 2.0 Configuration | Bitwarden Help Center

Google SAML Implementation | Bitwarden Help Center

Now when I’m trying to log in using SSO, I am still prompted for a master password.
When I’m trying to test SAML login in Google app’s settings, I receive the error:
There was an unexpected error during single sign-on. Please close this page and try again. Unsolicited responses are not allowed for idp "https://accounts.google.com/o/saml2?idpid=***".

If I activate the option “Allow Unsolicited Authentication Response” in Bitwarden’s Single Sign-On settings, the error looks like this:
There was an unexpected error during single sign-on. Please close this page and try again. Unsolicited SAML response received, but no ReturnUrl is configured. When receiving unsolicited SAML responses (i.e. IDP initiated login), Saml2 will redirect the client to the configured ReturnUrl after successful authentication, but it is not configured. In code-based config, add a ReturnUrl by setting the options.SpOptions.ReturnUrl property. In the config file, set the returnUrl attribute of the <sustainsys.saml2> element.

What am I doing wrong? Where can I customize ReturnUrl, if it’s necessary?

[tgreer (Trey Greer)]

Welcome, @Not_Honest!

Just a quick note - even with SSO configured, users retain a Master Password such that they are in control of their Vault keys.

I’m not sure offhand what the issue may be, but as an enterprise subscriber, you are entitled to priority support from our team: https://bitwarden.com/contact

[hdub-tech (H Dub)]

(I know this is an old issue but I figured I would update it just for completeness, as I too stumbled across it looking for an answer, having missed the obvious the first time )

The Allow Unsolicited Authentication Response option has since been removed and the second link in the original post has been updated to include:

Note: Bitwarden does not support unsolicited responses, so initiating login from your IdP will result in an error. The SSO login flow must be initiated from Bitwarden.